Influxdb2 write mode

[forestmvey]

Summary

Adds an operator-controlled INFLUXDB_WRITE_MODE environment variable that governs whether write-producing Flux operations (to(), experimental.to(), wideTo()) are permitted through the InfluxDBQuery tool. When disabled (the default), queries containing these functions are rejected before reaching InfluxDB.

Changes

• New INFLUXDB_WRITE_MODE environment variable (default: false). Operator-controlled and not overridable by tool callers.
• validate_flux_query() function that detects write-producing Flux patterns and rejects them when write mode is disabled. Handles pipe-forward syntax, qualified calls, aliased imports, and ignores commented-out code.
• Validation integrated into InfluxDBQuery before any network call is made.
• 21 new tests covering blocked patterns, false-positive avoidance, write-mode opt-in, and normal read queries passing through.

User experience

Please share what the user experience looks like before and after this change

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• I have reviewed the contributing guidelines
• I have performed a self-review of this change
• Changes have been tested
• Changes are documented

Is this a breaking change? (Y/N)

N

RFC issue number:

Checklist:

• Migration process documented
• Implement warnings (if it can live side by side)

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.