feat(vendor-assessment): AVV/SCC/TOM/Sub-Processor checklists + assessment service

Phase 1-3 of the Vendor Contract Assessment:

Backend checklists (Doc-Check L1/L2 engine compatible):
- avv_checks.py: 28 checks (11 L1 + 17 L2) for Art. 28(3) DSGVO
- scc_checks.py: 7 checks for EU SCC 2021 (modules, annexes, TIA)
- tom_annex_checks.py: 12 checks for Art. 32 (8 control objectives)
- sub_processor_checks.py: 7 checks for sub-processor list completeness

Assessment service:
- POST /vendor-compliance/assessments — async contract analysis
- GET /vendor-compliance/assessments/{id} — poll status
- Cross-check engine: detects missing SCC when AVV mentions third-country,
  missing TOM annex, missing sub-processor list

All checklists registered in runner.py CHECKLIST_MAP (27 doc_types total).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/main.py

@@ -50,6 +50,7 @@ from compliance.api.agent_recurring_routes import router as agent_recurring_rout
 from compliance.api.agent_compare_routes import router as agent_compare_router
 from compliance.api.agent_doc_check_routes import router as agent_doc_check_router
 from compliance.api.agent_compliance_check_routes import router as agent_compliance_check_router
+from compliance.api.vendor_assessment_routes import router as vendor_assessment_router
 
 # Middleware
 from middleware import (
@@ -155,6 +156,9 @@ app.include_router(agent_compare_router, prefix="/api")
 app.include_router(agent_doc_check_router, prefix="/api")
 app.include_router(agent_compliance_check_router, prefix="/api")
 
+# Vendor Contract Assessment
+app.include_router(vendor_assessment_router, prefix="/api")
+
 
 if __name__ == "__main__":
     import uvicorn