[codex] fix query safety and citation numbering

[sarthakagrawal927]

What changed

• Hardened structured-query filter handling by rejecting unsafe filter keys before SQL interpolation.
• Allowed compare questions to use the structured entity-table path, not just aggregate questions.
• Reworked query citations so graph-route sources and retrieval sources share one global numbering space.
• Added tests for unsafe filter keys, compare-path coverage, and combined source numbering.

Why

• The structured SQL path was interpolating LLM-derived filter keys directly into SQL.
• Compare questions were being routed to a helper that immediately returned None.
• Graph-route citations were numbered independently from retrieval citations, which made inline [n] markers ambiguous and the final citation list inconsistent with what the model saw.

Validation

• uv run pytest -q tests/test_query_synthesis.py tests/test_duckdb_helpers.py
• uv run ruff check src/kb/query/engine.py src/kb/query/structured.py tests/test_query_synthesis.py