fix(dashboard): harden BigQuery connector for PR #142

[caohy1988]

Why

Reference implementation for the data connector fixes discussed on #142.

PR #142 adds dashboard_v2/ and the Vercel dashboard shell, but the current /api BigQuery connector has three practical issues:

• it builds a table reference directly from request headers without validating identifiers;
• it passes a partial credentials object when GCP_CLIENT_EMAIL / GCP_PRIVATE_KEY are absent, which breaks local ADC / GOOGLE_APPLICATION_CREDENTIALS setups;
• it returns raw agent_events rows even though the UI expects graph-friendly fields like id, parent_id, type, label, latency, and total_tokens.

I could not push directly to Saherpathan's PR branch, so this draft PR shows the concrete patch for the author to cherry-pick or copy.

What

• Harden dashboard_v2/api/index.ts:
  • validates Project ID, Dataset ID, and Table ID before composing SQL;
  • supports both Vercel service-account env vars and local ADC / GOOGLE_APPLICATION_CREDENTIALS;
  • normalizes BigQuery Agent Analytics rows into the shape consumed by the React components;
  • keeps timespan values allowlisted.
• Update dashboard_v2/src/services/apiService.ts to URL-encode the timespan value.
• Fix dashboard docs:
  • local BigQuery-backed path should use npx vercel dev, not bare Vite;
  • clarify the two auth modes and service-account permissions.
• Replace the dead npm start script (server.cjs does not exist) with vite preview --host=0.0.0.0.

Verification

Run from dashboard_v2/:

• npm ci -> clean, 0 vulnerabilities
• npm run lint -> clean (tsc --noEmit)
• npm run build -> clean; Vite emits only the existing large-chunk warning
• git diff --check -> clean

Notes

This is intentionally marked draft because it is a reference patch for #142, not a competing dashboard submission. The preferred path is for #142's author to incorporate these connector changes into their branch.