PII Remover: Fix validator on_fail error #167

Bug

Running any pii_remover validator (saved config or inline) fails at run time:

Invalid on_fail value: fix. Expected one of: exception, fix, rephrase.

Reproduced on staging via kaapi-backend POST /guardrails with a PII config (on_fail_action: fix), job status FAILED, no output.

Root cause

PR #165 added model_config = ConfigDict(use_enum_values=True) to PIIRemoverSafetyValidatorConfig so Presidio receives plain-string entity types. use_enum_values is model-wide, so it also coerces the inherited on_fail: GuardrailOnFail and stage: Stage fields to plain strings.

• BaseValidatorConfig.resolve_on_fail() compares self.on_fail == GuardrailOnFail.Fix. GuardrailOnFail is a plain Enum (no str mixin), so "fix" != GuardrailOnFail.Fix and the method falls through to raise ValueError(...).
• routes/guardrails.py calls config.stage.value when writing validator logs; with stage coerced to "input" this raises AttributeError: 'str' object has no attribute 'value'.

Unit tests missed it because they relied on the default on_fail; pydantic does not validate defaults, so the enum stayed an enum.

PIIRemoverSafetyValidatorConfig(type="pii_remover", on_fail="fix").resolve_on_fail()
# ValueError: Invalid on_fail value: fix. ...
PIIRemoverSafetyValidatorConfig(type="pii_remover", stage="input").stage.value
# AttributeError: 'str' object has no attribute 'value'

Fix

Drop use_enum_values and convert entity_types to .value strings inside build(), right before handing them to Presidio. Enums stay on the model (strict validation unchanged), Presidio still gets plain strings. Add a regression test that passes on_fail explicitly for all three values.