Add natural-language query drafting for YAAQL

[jusso-dev]

Problem

YAAQL is useful, but analysts still need to know the exact field aliases, operators, and syntax. A natural-language query drafting workflow would speed investigations while keeping the generated query visible and editable.

Scope

Add a draft query action to the Hunt page that turns a natural-language request into a YAAQL query, explains the query, and lets the analyst run or edit it.

Implementation Notes

• Add an endpoint such as /api/copilot/query.
• Input: natural-language prompt, optional current query, optional selected alert/case context.
• Output: query, explanation, assumptions, warnings, and suggestedPivots.
• Validate the generated query with the existing YAAQL parser before returning success.
• If the query is invalid, return the parser error and a repaired candidate if available.
• Add a drawer or inline panel to components/hunt-console.tsx.
• Keep the generated YAAQL visible before execution.
• Avoid auto-running generated queries unless the analyst clicks Run.

Acceptance Criteria

• Analysts can enter "show critical PowerShell alerts on Windows hosts from the last day" and receive editable YAAQL.
• Invalid generated YAAQL is clearly marked before execution.
• The generated query can be inserted into the existing hunt editor.
• The query explanation references field aliases used by YAAQL.
• Drafting does not save or run the query without an explicit analyst action.

Tests

• Unit test prompt-to-query response validation wrapper.
• Unit test generated queries are parsed before success.
• Component test draft insertion updates the Hunt editor.
• API test unauthorized users cannot draft queries.