Story 2.2: ArangoDB OKF meta collections + repository CRUD API

As a steward, I want to create, list, read, update, and delete OKF repositories, each with its own graph, So that domains are isolated and managed independently.

Acceptance Criteria: Given the OKF control-plane collections (okf_repositories, okf_concepts_meta, okf_audit, okf_sources) in the same ArangoDB database as the graphs, When a tools-admin steward calls /api/okf/repos, Then create mints repo_id + reserves graph_name=OKF_{repo_id} (graph auto-created on first ingest), binds it to a domain (service-category key); list/read is scoped to authorized domains/repos; update changes metadata/ACL/retention (not graph_name); delete cascades — retracts the entire graph + metadata, audited, irreversible after a grace window, And all schema/integrity is enforced at the app layer (ADR-okf-018). (FR-23, FR-3; Architecture §2, §4, §5; ADR-okf-014, ADR-okf-018)

---

Epic 2 · PRD: okf-server · Sprint key: 2-2-arangodb-meta-collections-repo-crud · Branch: feat/okf-server