Schema anonymisation mode (--anonymize)

[Cyberfilo]

Add --anonymize that maps table/column names to opaque tokens before they go into the prompt, and maps the generated SQL back. Lets users try PromptQuery against sensitive schemas without sending real names to an LLM — a real adoption blocker for EU/regulated teams.

Scope: a small mapping layer used by prompts.format_schema + a reverse pass on the generated SQL. Discuss the approach in the issue first.

[wondr-wclabs]

I can take this on if the shape below sounds right.

Proposed approach:

• Add a small SchemaAnonymizer layer, likely in a new module, that builds deterministic mappings for selected tables/columns: real qualified table names -> opaque table tokens, and real column names within each table -> opaque column tokens.
• Keep TF-IDF retrieval and FK expansion on the real schema locally, so user questions like “orders by customer” still match the actual schema before anything is anonymized.
• Apply anonymization only to the schema text sent to LLMs:
  • generator prompt via prompts.format_schema / build_system_prompt
  • table-selector candidate block in retrieval.llm_select_tables, since that path currently also exposes real table/column names
• After extract_sql(raw), reverse-map opaque identifiers back to real identifiers before validate_select_only() and db.execute(). That keeps the existing sqlglot safety guard and read-only DB layer unchanged.
• Add --anonymize as a Click flag and thread the anonymizer through run_question(), one-shot, and REPL paths.

Tests I would add:

• schema anonymizer preserves structure: table names, column names, PK/NOT NULL markers, and FK references are anonymized consistently
• generated SQL reverse-maps back before validation/execution
• selector prompt does not contain original table/column names when anonymization is on
• safety tests remain unchanged, with maybe one regression proving reverse-mapped DML is still rejected

I’d avoid new runtime dependencies and keep comments/table comments out of anonymized prompts unless you prefer retaining anonymized placeholders for them.