feat(use-case-controls): Adressat-Achse — out-of-scope advisory + additiver GOV-Tag

2-Pass-Haiku-Klassifikation (konservativ + Re-Confirm jeder Nicht-unternehmen-
Einstufung) der Review-Tier-Atome: wer muss die Pflicht erfuellen?

- Migration 155: atom_classification.addressee (unternehmen/oeffentliche_stelle/
  aufsichtsbefugnis/staat_eu/dritter/meta), additiv, kein CHECK. [migration-approved]
- Service: addressee + applicable + is_gov pro Control; include_out_of_scope-Param
  (Default false -> out-of-scope advisory ausgeblendet, NIE geloescht); out_of_scope_count.
  Pure Helper addressee_applicable/addressee_is_gov (+ Tests).
- Route: optionaler include_out_of_scope-Query (contract-safe, additiv).
- Frontend: GOV-Chip (additiv) + "kein Kunden-Pruefaspekt"-Chip + 1-Klick-Toggle
  zum Einblenden der out-of-scope-Atome.

Daten: 40.859 Adressat-Tags auf macmini geladen (81% applicable, 19% advisory,
3.146 GOV). Konservativ: NULL/Unklar = applicable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend-compliance/compliance/tests/test_use_case_controls.py

@@ -9,6 +9,8 @@ import pytest
 from compliance.domain import NotFoundError
 from compliance.services.use_case_controls import (
     UseCaseControlsService,
+    addressee_applicable,
+    addressee_is_gov,
     relevance_score,
     source_type,
     tier_label,
@@ -71,3 +73,21 @@ def test_source_type_own_library_vs_derived():
     assert source_type(1) == "derived"
     assert source_type(2) == "derived"
     assert source_type(None) == "derived"
+
+
+def test_addressee_applicable_defaults_to_true_when_unknown():
+    # NULL / company / public body = applicable (nothing hidden by default)
+    assert addressee_applicable(None) is True
+    assert addressee_applicable("unternehmen") is True
+    assert addressee_applicable("oeffentliche_stelle") is True
+
+
+def test_addressee_applicable_false_for_out_of_scope():
+    for ad in ("aufsichtsbefugnis", "staat_eu", "dritter", "meta"):
+        assert addressee_applicable(ad) is False
+
+
+def test_addressee_is_gov_only_for_public_body():
+    assert addressee_is_gov("oeffentliche_stelle") is True
+    assert addressee_is_gov("unternehmen") is False
+    assert addressee_is_gov(None) is False