feat(cra): coarse priority engine — P0 floor + customer weights + quick wins

Deterministic prioritisation on top of the mapper (cra_prioritizer.py): a
non-negotiable P0 floor (safety-function compromise / actively exploited /
CRITICAL — customer weights cannot demote) plus a discretionary tier ranked by
severity x the customer's weight (high/medium/low) for the 5 business objectives
(access/data/network_api/supply_updates/monitoring). Quick-win flag (high impact,
low effort) for a second view; each finding carries a short priority reason.
Endpoint accepts weights + per-finding safety_impact/exploited. Rough pre-sort
only (devs re-sort in Jira). No DB.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend-compliance/tests/test_cra_finding_mapper.py

@@ -77,7 +77,8 @@ def test_payload_entry_is_json_serializable_and_deterministic():
     assert r1 == r2  # deterministic
     assert r1["findings_total"] == 2
     assert isinstance(r1["mapped"], list) and isinstance(r1["mapped"][0], dict)
-    assert r1["mapped"][0]["primary_requirement"] == "CRA-AI-9"
+    by_id = {m["finding_id"]: m for m in r1["mapped"]}  # order is now priority-sorted
+    assert by_id["x"]["primary_requirement"] == "CRA-AI-9"
 
 
 def test_empty_payload_is_safe():