HEL-543 返工: 补充 observability 运行时可关闭开关 (DATAHUB_OBSERVABILITY)

总工复核 🔴：安全边界要求新增观测功能必须可关闭、关闭后现有功能完全照旧，
但此前实现没有任何运行时开关。修复：

- settings.py: 新增 Settings.observability_enabled 字段，沿用既有
  DATAHUB_SCHEDULER 的环境变量模式，读取 DATAHUB_OBSERVABILITY
  (0/false/off 关闭，默认开启)。
- hub.py: Hub.__init__ 把 settings.observability_enabled 挂到
  self.db 上，让 pipeline/realtime_serve/steward/admin_api 已经
  在传的 db 参数直接带上开关，零额外改造。
- observability.py: 新增 is_enabled(db)，缺失该属性时默认按启用处理
  (向后兼容裸 HubDB 用例/测试)。关闭时 observe() 变成纯
  透传（不计时、不分类、不碰数据库)，record_call() 直接 no-op。
- admin_api.py: 4 个新只读端点关闭时返回明确的
  {"enabled": false, ...空结构} 而不是静默返回旧数据。
- 新增 10 个测试：开关默认值/环境变量解析、关闭后 observe() 的透传语义
  (含异常原样重新抛出)、关闭后 record_call() 零写入、关闭后重新开启恢复
  记录、4 个 admin 端点在关闭态的响应结构。

全量测试 183/183 通过（新增 10 个，含此前 173 个零回归）。

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: multica-agent <github@multica.ai>

xiaobai-datahub/tests/test_admin_observability_api.py

@@ -124,6 +124,41 @@ class AdminObservabilityApiTests(unittest.TestCase):
         self.assertEqual(body["provider"], "tushare")
         self.assertEqual(body["interface"], "daily")
 
+    def test_disabled_kill_switch_reports_enabled_false_with_empty_structure(self) -> None:
+        # HEL-543 total-review 🔴: flip the runtime kill switch the same way
+        # Hub.__init__ wires Settings.observability_enabled onto the db
+        # handle, then confirm every new endpoint reports disabled with an
+        # explicit empty structure rather than silently going quiet.
+        self.hub.db.observability_enabled = False
+        try:
+            pipeline = self.hub.pipeline
+            pipeline.ingest_reference(TRADE_DATE)
+            pipeline.run_dataset("daily", TRADE_DATE)  # must still fully succeed
+
+            status, body, _ = self._get("/admin/api/providers/status")
+            self.assertEqual(status, 200)
+            self.assertEqual(body, {"enabled": False, "health": [], "recent_calls": []})
+
+            status, body, _ = self._get("/admin/api/source-catalog")
+            self.assertEqual(status, 200)
+            self.assertEqual(body, {"enabled": False, "items": []})
+
+            status, body, _ = self._get("/admin/api/lineage")
+            self.assertEqual(status, 200)
+            self.assertFalse(body["enabled"])
+            self.assertEqual(body["items"], [])
+
+            status, body, _ = self._get("/admin/api/lineage/affected?provider=tushare")
+            self.assertEqual(status, 200)
+            self.assertEqual(
+                body, {"enabled": False, "provider": "tushare", "interface": "", "items": []}
+            )
+
+            # Nothing was ever written while disabled.
+            self.assertEqual(self.hub.db.fetchall("SELECT * FROM provider_call_log"), [])
+        finally:
+            self.hub.db.observability_enabled = True
+
     def test_must_change_password_blocks_new_endpoints_too(self) -> None:
         from urllib.error import HTTPError