feat: add drift and unrouted-query clustering with privacy controls

Summary

Add drift and unrouted-query clustering so operators can identify missing recipes, weak signals, and routing regressions while preserving privacy controls.

Parent roadmap: #2287 Parent issue: #2345 Related: #2330, #2333, #2335, #2341 Related code: src/semantic-router/pkg/routerreplay, src/semantic-router/pkg/observability, dashboard/backend/evaluation, dashboard/backend, src/training

Motivation

Unrouted or low-confidence traffic is the strongest signal for new recipes, signal extractors, and calibration work. However, clustering must avoid turning replay into an unsafe raw prompt mining feature.

Scope

Define and implement:

• low-confidence/unrouted sample selection;
• embedding/signal drift metrics;
• clustering summaries with redaction and retention controls;
• export paths for eval/tuning datasets;
• links from clusters to recipe/signal improvement workflows.

Non-goals

• Do not retain raw sensitive prompts without explicit policy.
• Do not let clustering automatically mutate routing config.
• Do not replace formal evaluation datasets.

Acceptance criteria

• Operators can see anonymized drift/unrouted clusters.
• Cluster outputs can seed eval or tuning workflows with explicit approval.
• Privacy and retention behavior is documented and tested.