feat(lookup)!: return null for not-found, v0.2.1 (AGG-113)

[anthrax63]

Summary

AGG-113 API contract fix — /single and /multi now return null for pairs
that don't exist on the PKB replica, and status codes are cleaned up so a
missing pair no longer risks a 408 timeout.

Before: /single returned [] on not-found, which was ambiguous with an
iin-only lookup that happens to have zero rows, and /multi had no way to
express «one item was not found» distinct from «one item's lookup failed».

After:

• GET /single?iin=X&phone=Y — found → object, not found → null.
• GET /single?iin=X (no phone) — found → array, not found → null.
• POST /multi — per-item: object | array | null | error, same order as input.
• OpenAPI responses.200.schema is oneOf: [object, array, null] for /single
  and array-of-that-plus-error for /multi.
• 408 stays reserved for real slowness in vaultee-pipelines / DDM; a
  successful pipeline run that returns an empty payload is now a plain 200 null.

Bump: 0.2.0 → 0.2.1 — contract widen. Old callers that already
tolerated [] must now also handle null.

Not in this PR

The AGG-113 description also asks for a pipeline-side fast-path on 0-row
ClickHouse lookups. Skipped here because:

• Pipeline is not currently runnable end-to-end: existing
  lookup_by_beeline*.yaml.tmpl uses publish_to_session { type: file }
  which DDM does not support (Publish file in session is not supported
  — ddm/crates/task_executors/io_operation/src/publish_to_session.rs).
• Per AGG-112 Stage 6, the DDM Beeline executor is not polling tasks
  at all right now, so no lookup pipeline actually runs — the 30s client
  timeouts observed in prod are «tasks stuck in PENDING», not «0-row
  hang in pull → decrypt → publish».
• Landing a pipeline fast-path is worthwhile only after (a) the executor
  is back and (b) publish_to_session for lookup results is redesigned
  to fit DDM's supported shapes (JSON via extract, not file). Both are
  out of scope for this PR and belong in a follow-up saga.

Test plan

• pytest -q — 50 passed
• ruff check src tests — all checks passed
• Follow-up: DevOps bump image tag to v0.2.1 in
  kartel-deploy/argo/overlays/vaultee/kz-scoring-api.yaml after CI
  publishes the image.
• Follow-up: consumer of /single / /multi handles null (previously
  []) — coordinate with Beeline-API team before rollout.

🤖 Generated with Claude Code