feat(use-case-controls): Adressat-Achse — out-of-scope advisory + additiver GOV-Tag

2-Pass-Haiku-Klassifikation (konservativ + Re-Confirm jeder Nicht-unternehmen-
Einstufung) der Review-Tier-Atome: wer muss die Pflicht erfuellen?

- Migration 155: atom_classification.addressee (unternehmen/oeffentliche_stelle/
  aufsichtsbefugnis/staat_eu/dritter/meta), additiv, kein CHECK. [migration-approved]
- Service: addressee + applicable + is_gov pro Control; include_out_of_scope-Param
  (Default false -> out-of-scope advisory ausgeblendet, NIE geloescht); out_of_scope_count.
  Pure Helper addressee_applicable/addressee_is_gov (+ Tests).
- Route: optionaler include_out_of_scope-Query (contract-safe, additiv).
- Frontend: GOV-Chip (additiv) + "kein Kunden-Pruefaspekt"-Chip + 1-Klick-Toggle
  zum Einblenden der out-of-scope-Atome.

Daten: 40.859 Adressat-Tags auf macmini geladen (81% applicable, 19% advisory,
3.146 GOV). Konservativ: NULL/Unklar = applicable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

admin-compliance/app/sdk/coverage/_helpers.ts

@@ -94,6 +94,9 @@ export interface ControlItem {
   relevant: boolean
   tier: 'core' | 'review'
   source_type: 'derived' | 'own_library'
+  addressee?: string | null
+  applicable: boolean
+  is_gov: boolean
 }
 
 export interface ControlsResponse {
@@ -105,6 +108,8 @@ export interface ControlsResponse {
   total: number
   core_count: number
   review_count: number
+  out_of_scope_count: number
+  include_out_of_scope: boolean
   limit: number
   offset: number
   sub_topic: string | null
@@ -112,6 +117,22 @@ export interface ControlsResponse {
   controls: ControlItem[]
 }
 
+// Addressee axis: who must fulfil an obligation. out-of-scope (authority power /
+// member-state-EU / third party / meta) is advisory — hidden by default, never
+// deleted. oeffentliche_stelle = additive GOV hint (public-sector customer).
+export const ADDRESSEE_LABELS: Record<string, string> = {
+  unternehmen: 'Unternehmen',
+  oeffentliche_stelle: 'Öffentliche Stelle',
+  aufsichtsbefugnis: 'Aufsichtsbehörde',
+  staat_eu: 'Mitgliedstaat/EU',
+  dritter: 'Dritter',
+  meta: 'Meta',
+}
+
+export function addresseeLabel(a?: string | null): string {
+  return a ? ADDRESSEE_LABELS[a] || a : ''
+}
+
 // Provenance line: own library vs derived-from-document (with the document, and
 // article when known). The user wants to see WHERE a derived control came from.
 export function provenanceLabel(