feat(audit): Cookie-Compliance-Audit (3-Quellen-Vergleich) + Vendor-Dedup + Block-Parser

ZENTRALER USP: cookie_compliance_audit.py vergleicht 3 Quellen
* DEKLARIERT in Cookie-Richtlinie (parse_cookie_table + parse_flat)
* TATSAECHLICH im Browser geladen (banner_result.phases.after_accept)
* LIBRARY-Metadaten (cookie_library lookup)

Liefert 3 Listen mit Compliance-Verdict:
* compliant (deklariert UND geladen) — gruener Block
* undeclared_in_browser (geladen NICHT deklariert) — ROTER HIGH-Block
  → Art. 13(1)(c) DSGVO + § 25 TDDDG Verstoss
* declared_not_loaded (deklariert NICHT geladen) — gelber Hinweis
  → Tabelle moeglicherweise veraltet

parse_cookie_table erweitert um Block-Format (5 Zeilen pro Cookie wie
beim User-Copy aus VW). Findet 35+ Cookies aus Copy-Paste statt 0.

vendor_normalizer.py: 50+ Aliases (Google-Familie, Adobe-Familie,
Trade Desk, AdForm, ...) + Garbage-Filter (URLs, leere Strings,
'click to select', 'Mehrere OEMs'). Mergt cookies-Listen beim Dedup.

_guess_vendor erweitert: Adobe-Familie (s_ecid/AMCV/demdex/mbox/...),
Trade Desk (TDID/TDCPM/TTDOptOut), AdForm (uid/cid/otsid),
Salesforce LiveAgent, etracker, Akamai, EDAA.

audit_quality_checks: vendor-thin-Threshold jetzt dynamisch nach
Cookie-Doc-Wörter (3k→10 / 6k→20 / 10k→30 / 15k+→40).

VW-Test-Fixture: tests/fixtures/cookie_gt/vw_cookie_richtlinie.txt
(36-Cookie-Sample fuer Regression-Tests).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/api/agent_compliance_check_routes.py

@@ -948,6 +948,15 @@ async def _run_compliance_check(check_id: str, req: ComplianceCheckRequest):
                 except Exception as e:
                     logger.warning("Cookie-Library-Fallback skipped: %s", e)
 
+            # Vendor-Normalizer: Dedup (Google-Familie etc) + Garbage-Filter
+            try:
+                from compliance.services.vendor_normalizer import (
+                    normalize_vendors as _norm_v,
+                )
+                cmp_vendors = _norm_v(cmp_vendors)
+            except Exception as e:
+                logger.warning("vendor_normalizer skipped: %s", e)
+
             # P50: enrich vendors with per-vendor detail-modal-extracts
             # (description, opt-out URL, privacy URL, cookies). Detail
             # comes from Phase G Info-button-click-through in /scan.
@@ -1276,6 +1285,38 @@ async def _run_compliance_check(check_id: str, req: ComplianceCheckRequest):
         except Exception as e:
             logger.warning("Scope-disclaimer block skipped: %s", e)
 
+        # COOKIE-COMPLIANCE-AUDIT (3-Quellen-Vergleich) — das ist der
+        # zentrale USP: deklariert in Richtlinie vs tatsaechlich im
+        # Browser geladen vs Library-Match.
+        cookie_audit = {}
+        cookie_audit_html = ""
+        try:
+            from compliance.services.cookie_compliance_audit import (
+                audit_cookie_compliance, build_cookie_audit_block_html,
+            )
+            from database import SessionLocal as _SLca
+            _ca_db = _SLca()
+            try:
+                cookie_audit = audit_cookie_compliance(
+                    _ca_db, doc_texts.get("cookie") or doc_texts.get("dse"),
+                    banner_result,
+                )
+                if cookie_audit and (cookie_audit.get("declared_count") or
+                                      cookie_audit.get("browser_count")):
+                    cookie_audit_html = build_cookie_audit_block_html(cookie_audit)
+                    logger.info(
+                        "Cookie-Audit: %d deklariert, %d im Browser, "
+                        "%d undokumentiert, %d compliant",
+                        cookie_audit.get("declared_count"),
+                        cookie_audit.get("browser_count"),
+                        len(cookie_audit.get("undeclared_in_browser") or []),
+                        len(cookie_audit.get("compliant") or []),
+                    )
+            finally:
+                _ca_db.close()
+        except Exception as e:
+            logger.warning("cookie-compliance-audit skipped: %s", e)
+
         # P102: Cookie-Klassifikations-Pruefung (deklariert vs Library)
         library_mismatch_html = ""
         mismatches: list[dict] = []
@@ -1481,7 +1522,9 @@ async def _run_compliance_check(check_id: str, req: ComplianceCheckRequest):
             + critical_html + scope_disclaimer_html + exec_summary_html
             + cookie_arch_html + summary_html + scanned_html + profile_html
             + scorecard_html + redundancy_html
-            + providers_html + banner_deep_html + library_mismatch_html
+            + providers_html + banner_deep_html
+            + cookie_audit_html
+            + library_mismatch_html
             + consistency_html + signals_html + solutions_html
             + jc_decision_html
             + vvt_html + report_html