feat: Phase 2 — RAG integration in Requirements + DSFA Draft

Add legal context enrichment from Qdrant vector corpus to the two
highest-priority modules (Requirements AI assistant and DSFA drafting
engine).

Go SDK:
- Add SearchCollection() with collection override + whitelist validation
- Refactor Search() to delegate to shared searchInternal()

Python backend:
- New ComplianceRAGClient proxying POST /sdk/v1/rag/search (error-tolerant)
- AI assistant: enrich interpret_requirement() and suggest_controls() with RAG
- Requirements API: add ?include_legal_context=true query parameter

Admin (Next.js):
- Extract shared queryRAG() utility from chat route
- Inject RAG legal context into v1 and v2 draft pipelines

Tests for all three layers (Go, Python, TypeScript shared utility).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ai-compliance-sdk/internal/api/handlers/rag_handlers.go

@@ -21,9 +21,20 @@ func NewRAGHandlers(corpusVersionStore *ucca.CorpusVersionStore) *RAGHandlers {
 	}
 }
 
+// AllowedCollections is the whitelist of Qdrant collections that can be queried.
+var AllowedCollections = map[string]bool{
+	"bp_compliance_ce":           true,
+	"bp_compliance_recht":        true,
+	"bp_compliance_gesetze":      true,
+	"bp_compliance_datenschutz":  true,
+	"bp_dsfa_corpus":             true,
+	"bp_legal_templates":         true,
+}
+
 // SearchRequest represents a RAG search request.
 type SearchRequest struct {
 	Query       string   `json:"query" binding:"required"`
+	Collection  string   `json:"collection,omitempty"`
 	Regulations []string `json:"regulations,omitempty"`
 	TopK        int      `json:"top_k,omitempty"`
 }
@@ -41,7 +52,15 @@ func (h *RAGHandlers) Search(c *gin.Context) {
 		req.TopK = 5
 	}
 
-	results, err := h.ragClient.Search(c.Request.Context(), req.Query, req.Regulations, req.TopK)
+	// Validate collection if specified
+	if req.Collection != "" {
+		if !AllowedCollections[req.Collection] {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "Unknown collection: " + req.Collection + ". Allowed: bp_compliance_ce, bp_compliance_recht, bp_compliance_gesetze, bp_compliance_datenschutz, bp_dsfa_corpus, bp_legal_templates"})
+			return
+		}
+	}
+
+	results, err := h.ragClient.SearchCollection(c.Request.Context(), req.Collection, req.Query, req.Regulations, req.TopK)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "RAG search failed: " + err.Error()})
 		return