fix(backend): constrain visualization target lambdas

[cursor]

Description of your changes:

Severity: High

The visualization API forwards user-controlled visualization fields into a notebook that runs inside the visualization server pod. A caller who can create visualizations controlled visualization.source and ROC arguments.target_lambda; the service interpolated source directly into Python syntax and evaluated target_lambda with eval, allowing arbitrary Python execution through non-custom visualization requests.

This change encodes source as a Python string literal and compiles ROC target lambdas only after AST validation. The validator keeps simple row arithmetic/comparison expressions but rejects calls, imports, attributes, comprehensions, and other executable syntax.

Primary location: backend/src/apiserver/visualization/types/roc_curve.py

Testing:

• PYTHONPATH=backend/src/apiserver/visualization python3 -m unittest backend/src/apiserver/visualization/test_safe_target_lambda.py
• PYTHONPATH=backend/src/apiserver/visualization python3 -m py_compile backend/src/apiserver/visualization/server.py backend/src/apiserver/visualization/safe_target_lambda.py backend/src/apiserver/visualization/types/roc_curve.py

Not run: full visualization server unittest in this runner, because system Python is missing tornado; pytest is also not installed.

Checklist:

• You have signed off your commits
• The title for your pull request (PR) should follow our title convention. Learn more.