feat(canonical-controls): Canonical Control Library — rechtssichere Security Controls

Eigenstaendig formulierte Security Controls mit unabhaengiger Taxonomie
und Open-Source-Verankerung (OWASP, NIST, ENISA). Keine BSI-Nomenklatur.

- Migration 044: 5 DB-Tabellen (frameworks, controls, sources, licenses, mappings)
- 10 Seed Controls mit 39 Open-Source-Referenzen
- License Gate: Quellen-Berechtigungspruefung (analysis/excerpt/embeddings/product)
- Too-Close-Detektor: 5 Metriken (exact-phrase, token-overlap, ngram, embedding, LCS)
- REST API: 8 Endpoints unter /v1/canonical/
- Go Loader mit Multi-Index (ID, domain, severity, framework)
- Frontend: Control Library Browser + Provenance Wiki
- CI/CD: validate-controls.py Job (schema, no-leak, open-anchors)
- 67 Tests (8 Go + 59 Python), alle PASS
- MkDocs Dokumentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

admin-compliance/lib/sdk/types.ts

@@ -906,6 +906,34 @@ export const SDK_STEPS: SDKStep[] = [
     prerequisiteSteps: ['academy'],
     isOptional: false,
   },
+  {
+    id: 'control-library',
+    seq: 4900,
+    phase: 2,
+    package: 'betrieb',
+    order: 11,
+    name: 'Control Library',
+    nameShort: 'Controls',
+    description: 'Canonical Security Controls mit Open-Source-Referenzen',
+    url: '/sdk/control-library',
+    checkpointId: 'CP-CLIB',
+    prerequisiteSteps: [],
+    isOptional: true,
+  },
+  {
+    id: 'control-provenance',
+    seq: 4950,
+    phase: 2,
+    package: 'betrieb',
+    order: 12,
+    name: 'Control Provenance',
+    nameShort: 'Provenance',
+    description: 'Herkunftsnachweis: Offene Quellen, Lizenzen, Too-Close-Pruefung',
+    url: '/sdk/control-provenance',
+    checkpointId: 'CP-CPROV',
+    prerequisiteSteps: [],
+    isOptional: true,
+  },
 ]
 
 // =============================================================================