Neo4j backends: read-only client + separate ingestor (all languages)

[rahlk]

Design contract for every Neo4j-backed analysis backend: TS now, Java
and Python to follow as their backends land.

A Neo4j backend must NOT do double duty (build the graph AND query it).
Wrong for cloud, where the DB is populated out-of-band (3rd-party job in
k8s) and the SDK only polls it.

Two pieces, per language:

• Neo4jBackend -> read-only Cypher client. No project_dir, no
  binary, no build_db. Connection + application_name only.
• Neo4jIngestor -> the writer. Shells out to codeanalyzer-
  --emit neo4j. Local/dev only.

Facade selects the backend, runs the ingestor only when build_db=True,
then always builds the read-only client.

Status:

• TypeScript (TSNeo4jBackend / TSNeo4jIngestor)
• Java (JNeo4jBackend / JNeo4jIngestor)
• Python (PyNeo4jBackend / PyNeo4jIngestor)