feat(sdk): Multi-Tenancy, Versionierung, Change-Requests, Dokumentengenerierung (Phase 1-6)

6-Phasen-Implementation fuer cloud-faehiges, mandantenfaehiges Compliance SDK:

Phase 1: Multi-Tenancy Fix
- Shared tenant_utils.py Dependency (UUID-Validierung, kein "default" mehr)
- VVT tenant_id Column + tenant-scoped Queries
- DSFA/Vendor DEFAULT_TENANT_ID von "default" auf UUID migriert
- Migration 035

Phase 2: Stammdaten-Erweiterung
- Company Profile um JSONB-Felder erweitert (processing_systems, ai_systems, technical_contacts)
- Regulierungs-Flags (NIS2, AI Act, ISO 27001)
- GET /template-context Endpoint
- Migration 036

Phase 3: Dokument-Versionierung
- 5 Versions-Tabellen (DSFA, VVT, TOM, Loeschfristen, Obligations)
- Shared versioning_utils.py Helper
- /{id}/versions Endpoints auf allen 5 Dokumenttypen
- Migration 037

Phase 4: Change-Request System
- Zentrale CR-Inbox mit CRUD + Accept/Reject/Edit Workflow
- Regelbasierte CR-Engine (VVT DPIA → DSFA CR, Datenkategorien → Loeschfristen CR)
- Audit-Trail
- Migration 038

Phase 5: Dokumentengenerierung
- 5 Template-Generatoren (DSFA, VVT, TOM, Loeschfristen, Obligations)
- Preview + Apply Endpoints (erzeugt CRs, keine direkten Dokumente)

Phase 6: Frontend-Integration
- Change-Request Inbox Page mit Stats, Filtern, Modals
- VersionHistory Timeline-Komponente
- SDKSidebar CR-Badge (60s Polling)
- Company Profile: 2 neue Wizard-Steps + "Dokumente generieren" CTA

Docs: 5 neue MkDocs-Seiten, CLAUDE.md aktualisiert
Tests: 97 neue Tests (alle bestanden)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/compliance/api/dsfa_routes.py

@@ -33,7 +33,11 @@ from classroom_engine.database import get_db
 logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/dsfa", tags=["compliance-dsfa"])
 
-DEFAULT_TENANT_ID = "default"
+from .tenant_utils import get_tenant_id as _shared_get_tenant_id
+
+# Legacy compat — still used by _get_tenant_id() below; will be removed once
+# all call-sites switch to Depends(get_tenant_id).
+DEFAULT_TENANT_ID = "9282a473-5c95-4b3a-bf78-0ecc0ec71d3e"
 
 VALID_STATUSES = {"draft", "in-review", "approved", "needs-update"}
 VALID_RISK_LEVELS = {"low", "medium", "high", "critical"}
@@ -909,3 +913,33 @@ async def export_dsfa_json(
     }
 
 
+# =============================================================================
+# Versioning
+# =============================================================================
+
+@router.get("/{dsfa_id}/versions")
+async def list_dsfa_versions(
+    dsfa_id: str,
+    tenant_id: Optional[str] = Query(None),
+    db: Session = Depends(get_db),
+):
+    """List all versions for a DSFA."""
+    from .versioning_utils import list_versions
+    tid = _get_tenant_id(tenant_id)
+    return list_versions(db, "dsfa", dsfa_id, tid)
+
+
+@router.get("/{dsfa_id}/versions/{version_number}")
+async def get_dsfa_version(
+    dsfa_id: str,
+    version_number: int,
+    tenant_id: Optional[str] = Query(None),
+    db: Session = Depends(get_db),
+):
+    """Get a specific DSFA version with full snapshot."""
+    from .versioning_utils import get_version
+    tid = _get_tenant_id(tenant_id)
+    v = get_version(db, "dsfa", dsfa_id, version_number, tid)
+    if not v:
+        raise HTTPException(status_code=404, detail=f"Version {version_number} not found")
+    return v