feat(graph): owner_id 寫入鏈必經(根治無主資料)——配合 base owner-mandatory(D28)

- kbdb-client requireOwner 守衛:漏 owner 插件端即 throw,不再靜默送 owner:''
- owner 一路 thread:persistNodes/ingestEnvelope/entity-crud/triplet-crud 全必填
- 病灶修:POST /triplets/ingest 原本沒傳 owner→加 owner_id query+400
- 寫入 route 缺 owner→400;vitest 23→27
- 註:gloss-bridge 分支的 backfill/gloss-entry 另需套 owner 必填(附說明),不跨支疊改

src/routes/entities.ts

@@ -54,13 +54,19 @@ entityRoutes.openapi(listPendingRoute, async (c) => {
 
 entityRoutes.post('/pending/:id/confirm', async (c) => {
   const id = c.req.param('id');
-  await confirmPendingAlias(makeKbdbClient(c.env), id);
+  // owner 必經：confirm 會 addAlias（重建 entity record），缺 owner→400 不寫無主資料。
+  const owner = c.req.query('owner_id')?.trim();
+  if (!owner) return c.json({ error: 'owner_id query parameter required（資料不可無主）' }, 400);
+  await confirmPendingAlias(makeKbdbClient(c.env), id, owner);
   return c.json({ success: true, action: 'confirmed', id });
 });
 
 entityRoutes.post('/pending/:id/reject', async (c) => {
   const id = c.req.param('id');
-  const newEntity = await rejectPendingAlias(makeKbdbClient(c.env), id);
+  // owner 必經：reject 會 createEntity，缺 owner→400 不寫無主資料。
+  const owner = c.req.query('owner_id')?.trim();
+  if (!owner) return c.json({ error: 'owner_id query parameter required（資料不可無主）' }, 400);
+  const newEntity = await rejectPendingAlias(makeKbdbClient(c.env), id, owner);
   return c.json({ success: true, action: 'rejected', newEntity });
 });