feat: /api/v1/meta-all aggregated cube catalog

[acmeguy]

Summary

• New GET /api/v1/meta-all endpoint. One call returns cube summaries across every datasource the caller can see (partition-filtered, same auth model as /discover).
• Each cube is stamped with datasource_id / branch_id / version_id so clients can immediately issue /load or /meta requests without a second lookup.
• Summary shape per cube: name, title, description, public, measures[], dimensions[], segments[], meta. Full objects are not returned — only names for fields and segments.
• Uses Promise.allSettled + per-datasource error list so one bad datasource does not fail the whole response.
• Auth: WorkOS RS256 or FraiOS HS256 bearer token.

Implementation notes

• Reuses the existing apiGateway.getCompilerApi(ctx).metaConfig() + filterVisibleItemsInMeta() pattern from loadExport.js, so access-list filtering (cubes / measures / dimensions the user cannot see) is applied per datasource.
• Builds a fresh security context per datasource via defineUserScope, so cube compilation and cache isolation continue to work exactly as with /meta.
• Partition filter reuses resolvePartitionTeamIds from discover.js.

Test plan

• curl with no token → 403 { error: "Authorization header required" }
• curl with valid FraiOS token → 200 with populated datasources[] including cube summaries (semantic_events: 73 measures, 138 dimensions)
• curl with token whose partition matches no team → 200 { datasources: [] }
• Verify in staging with a WorkOS token
• Smoke-test from client-v2 / cxs2

🤖 Generated with Claude Code