feat(provider): implement the native Graph driver (Neo4j or ArangoDB)

[devantler]

🤖 Generated by the Agentic Engineer

Child of #33. Blocked by the provider interface child.

User story

As a product author, I want type: graph with provider: native to give me a real graph engine for traversal-heavy workloads, rather than a relational approximation.

🔴 The engine is not chosen yet

#33 says "Neo4j (via official operator/Helm) or ArangoDB deployment" — that is an open decision, not an implementation detail, and the two differ in ways that outlive the code:

• Licensing. Neo4j's Community edition omits clustering and several enterprise features; ArangoDB changed licensing in 2023. Whichever is chosen, the licence has to be compatible with how this platform ships and self-hosts.
• Operator maturity and whether an official, maintained Kubernetes operator exists versus a Helm chart we would then own the lifecycle for.
• Query language (Cypher vs AQL) leaks into the published contract, so it is not swappable later without breaking consumers.

Record the decision and its rationale on #33 before implementing. If it needs its own investigation, split a Spike out of this child — a Spike's output is a recorded decision plus follow-ups, not a PR.

Acceptance criteria

• type: graph + provider: native provisions the chosen engine and reports readiness from its documented conditions.
• The connection contract is published as a Secret reference; no credentials in the CR.
• The query interface is expressed in the product's published output contract so consumers can discover it.
• Licence and operator-maturity rationale recorded on feat: Implement multi-engine provider support (Native + CNPG Hybrid) #33.
• Both feature-flag states tested.

Rough size: L, plus the decision above.