OG-CLEWS link framework: apply-patch endpoint and post-run coupled-run hook

[marcelolafleur]

This adds the backend seam that couples them through the ogclews-link tool: the OG side can patch a CLEWs case and re-solve it, and a finished CLEWs run can trigger a coupled OG run whose results register back to the case. The UI for this (coupled-run button on the OG setup page) comes in a follow-up PR building on this branch.

What

• POST /oglink/applyPatch — turns a link-emitted patch file into a solved caserun of a case copy (the live case is never touched, and a copy name can never overwrite a real case). Parameter codes translate through the case's own genData.json and fail loudly; values apply through the same read-merge /updateData uses; a generated-datafile line-count guard catches structure changes; the response carries per-change before/after provenance.
• Post-run hook — opt-in per case via <case>/oglink/hook.json. After a successful solve it runs the link CLI as a subprocess in the link's own venv (MUIOGO never imports it) and records the OG results under a new oglink-runs key in resData.json. Without the config file (or without the link installed) it is a no-op with one logged line, so CLEWs-only users are unaffected; a hook failure cannot affect the CLEWs run itself.
• UI-facing endpoints: GET /oglink/status (is the link installed; ?deep=1 also checks registered OG models), GET /oglink/runs?case=, GET/POST /oglink/hookConfig.
• Link run outputs live at ~/.muiogo/oglink-runs (same rule as og-state in Relocate OG-Core storage so it stops showing up as a CLEWS case #502), override MUIOGO_OGLINK_RUNS_DIR.

Everything is additive except a 13-line guarded insertion in DataFileClass.run().

Tested

• Endpoint acceptance: reproduced the link's validated +4.28% electricity-production response to +10% household demand (Philippines_v9) exactly.
• Real end-to-end run through the product path: POST /run on PEP_v9 → hook → full coupled OG-PHL solve → results registered in resData.json.
• 60+ behavior and adversarial checks: traversal attempts, overwrite protection, all-or-nothing patch validation, cross-site refusal, timeout tree-kill on both platforms.

cc: @autibet @Adityakushwaha2006 @error9098x

[marcelolafleur]

Handoff for the UI work (building on this branch):
@error9098x the UI goes on the OG setup page, three pieces:

1. A coupling form per case — country, base caserun, experiment. Read and save it with GET/POST /oglink/hookConfig?case=.
2. A results list — GET /oglink/runs?case= returns each run's status and result files. Philippines_v9 already has a real entry, so you can build against it right away.
3. A "run coupled" button — arm the config (enabled: true) and the run fires automatically after the next normal Run of the case.

Check GET /oglink/status first — if installed is false, hide it all and show the reason.

Two things to know: a coupled run can take a couple of hours, so never wait for it in a request — background it and let the results list update. And the result files live under ~/.muiogo/oglink-runs/, outside DataStorage, so downloading them needs a small new route.

If anything seems to need more than that — especially importing ogclews_link or ogcore into the app — stop and ping me first.