feat(sdk): Multi-Tenancy, Versionierung, Change-Requests, Dokumentengenerierung (Phase 1-6)

6-Phasen-Implementation fuer cloud-faehiges, mandantenfaehiges Compliance SDK:

Phase 1: Multi-Tenancy Fix
- Shared tenant_utils.py Dependency (UUID-Validierung, kein "default" mehr)
- VVT tenant_id Column + tenant-scoped Queries
- DSFA/Vendor DEFAULT_TENANT_ID von "default" auf UUID migriert
- Migration 035

Phase 2: Stammdaten-Erweiterung
- Company Profile um JSONB-Felder erweitert (processing_systems, ai_systems, technical_contacts)
- Regulierungs-Flags (NIS2, AI Act, ISO 27001)
- GET /template-context Endpoint
- Migration 036

Phase 3: Dokument-Versionierung
- 5 Versions-Tabellen (DSFA, VVT, TOM, Loeschfristen, Obligations)
- Shared versioning_utils.py Helper
- /{id}/versions Endpoints auf allen 5 Dokumenttypen
- Migration 037

Phase 4: Change-Request System
- Zentrale CR-Inbox mit CRUD + Accept/Reject/Edit Workflow
- Regelbasierte CR-Engine (VVT DPIA → DSFA CR, Datenkategorien → Loeschfristen CR)
- Audit-Trail
- Migration 038

Phase 5: Dokumentengenerierung
- 5 Template-Generatoren (DSFA, VVT, TOM, Loeschfristen, Obligations)
- Preview + Apply Endpoints (erzeugt CRs, keine direkten Dokumente)

Phase 6: Frontend-Integration
- Change-Request Inbox Page mit Stats, Filtern, Modals
- VersionHistory Timeline-Komponente
- SDKSidebar CR-Badge (60s Polling)
- Company Profile: 2 neue Wizard-Steps + "Dokumente generieren" CTA

Docs: 5 neue MkDocs-Seiten, CLAUDE.md aktualisiert
Tests: 97 neue Tests (alle bestanden)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/migrations/035_vvt_tenant_isolation.sql

@@ -0,0 +1,105 @@
+-- Migration 035: VVT Tenant Isolation + DSFA/Vendor "default" → UUID Fix
+-- Adds tenant_id to VVT tables, backfills existing data, fixes "default" tenant IDs
+
+BEGIN;
+
+-- ============================================================================
+-- 1. VVT Tables: Add tenant_id column
+-- ============================================================================
+
+ALTER TABLE compliance_vvt_organization
+    ADD COLUMN IF NOT EXISTS tenant_id VARCHAR(255);
+
+ALTER TABLE compliance_vvt_activities
+    ADD COLUMN IF NOT EXISTS tenant_id VARCHAR(255);
+
+ALTER TABLE compliance_vvt_audit_log
+    ADD COLUMN IF NOT EXISTS tenant_id VARCHAR(255);
+
+-- ============================================================================
+-- 2. Backfill existing VVT data to default tenant UUID
+-- ============================================================================
+
+UPDATE compliance_vvt_organization
+SET tenant_id = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+WHERE tenant_id IS NULL;
+
+UPDATE compliance_vvt_activities
+SET tenant_id = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+WHERE tenant_id IS NULL;
+
+UPDATE compliance_vvt_audit_log
+SET tenant_id = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+WHERE tenant_id IS NULL;
+
+-- ============================================================================
+-- 3. Make tenant_id NOT NULL after backfill
+-- ============================================================================
+
+ALTER TABLE compliance_vvt_organization
+    ALTER COLUMN tenant_id SET NOT NULL;
+
+ALTER TABLE compliance_vvt_activities
+    ALTER COLUMN tenant_id SET NOT NULL;
+
+ALTER TABLE compliance_vvt_audit_log
+    ALTER COLUMN tenant_id SET NOT NULL;
+
+-- ============================================================================
+-- 4. Replace global UNIQUE(vvt_id) with tenant-scoped UNIQUE(tenant_id, vvt_id)
+-- ============================================================================
+
+-- Drop old unique constraint (may be index or constraint)
+DROP INDEX IF EXISTS idx_vvt_activities_vvt_id;
+ALTER TABLE compliance_vvt_activities DROP CONSTRAINT IF EXISTS compliance_vvt_activities_vvt_id_key;
+
+-- Create tenant-scoped unique constraint
+ALTER TABLE compliance_vvt_activities
+    ADD CONSTRAINT uq_vvt_activities_tenant_vvt_id UNIQUE (tenant_id, vvt_id);
+
+-- ============================================================================
+-- 5. Add tenant_id indexes for performance
+-- ============================================================================
+
+CREATE INDEX IF NOT EXISTS idx_vvt_org_tenant ON compliance_vvt_organization(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_vvt_activities_tenant ON compliance_vvt_activities(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_vvt_activities_tenant_status ON compliance_vvt_activities(tenant_id, status);
+CREATE INDEX IF NOT EXISTS idx_vvt_audit_tenant ON compliance_vvt_audit_log(tenant_id);
+
+-- ============================================================================
+-- 6. Fix DSFA tables: "default" → UUID
+-- ============================================================================
+
+UPDATE compliance_dsfas
+SET tenant_id = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+WHERE tenant_id = 'default';
+
+UPDATE compliance_dsfa_audit_log
+SET tenant_id = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+WHERE tenant_id = 'default';
+
+-- ============================================================================
+-- 7. Fix Vendor tables: "default" → UUID
+-- ============================================================================
+
+UPDATE vendor_vendors
+SET tenant_id = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+WHERE tenant_id = 'default';
+
+UPDATE vendor_contracts
+SET tenant_id = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+WHERE tenant_id = 'default';
+
+UPDATE vendor_findings
+SET tenant_id = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+WHERE tenant_id = 'default';
+
+UPDATE vendor_control_instances
+SET tenant_id = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+WHERE tenant_id = 'default';
+
+UPDATE vendor_controls
+SET tenant_id = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+WHERE tenant_id = 'default';
+
+COMMIT;

backend-compliance/migrations/036_company_profile_extend.sql

@@ -0,0 +1,34 @@
+-- Migration 036: Extend company_profiles with systems, AI, legal context
+-- Adds structured JSONB fields for document generation and compliance automation
+
+BEGIN;
+
+-- ============================================================================
+-- 1. JSONB fields for systems & document sources
+-- ============================================================================
+
+ALTER TABLE compliance_company_profiles
+    ADD COLUMN IF NOT EXISTS repos JSONB DEFAULT '[]'::jsonb,
+    ADD COLUMN IF NOT EXISTS document_sources JSONB DEFAULT '[]'::jsonb,
+    ADD COLUMN IF NOT EXISTS processing_systems JSONB DEFAULT '[]'::jsonb,
+    ADD COLUMN IF NOT EXISTS ai_systems JSONB DEFAULT '[]'::jsonb,
+    ADD COLUMN IF NOT EXISTS technical_contacts JSONB DEFAULT '[]'::jsonb;
+
+-- ============================================================================
+-- 2. Regulatory booleans
+-- ============================================================================
+
+ALTER TABLE compliance_company_profiles
+    ADD COLUMN IF NOT EXISTS subject_to_nis2 BOOLEAN DEFAULT FALSE,
+    ADD COLUMN IF NOT EXISTS subject_to_ai_act BOOLEAN DEFAULT FALSE,
+    ADD COLUMN IF NOT EXISTS subject_to_iso27001 BOOLEAN DEFAULT FALSE;
+
+-- ============================================================================
+-- 3. Supervisory authority & review cycle
+-- ============================================================================
+
+ALTER TABLE compliance_company_profiles
+    ADD COLUMN IF NOT EXISTS supervisory_authority VARCHAR(255),
+    ADD COLUMN IF NOT EXISTS review_cycle_months INTEGER DEFAULT 12;
+
+COMMIT;

backend-compliance/migrations/037_document_versions.sql

@@ -0,0 +1,141 @@
+-- Migration 037: Document Versioning Tables
+-- Separate version tables for DSFA, VVT, TOM, Loeschfristen, Obligations
+-- Pattern: snapshot JSONB + status workflow + audit trail
+
+BEGIN;
+
+-- ============================================================================
+-- 1. Add current_version column to all 5 document tables
+-- ============================================================================
+
+ALTER TABLE compliance_dsfas
+    ADD COLUMN IF NOT EXISTS current_version INTEGER DEFAULT 0;
+
+ALTER TABLE compliance_vvt_activities
+    ADD COLUMN IF NOT EXISTS current_version INTEGER DEFAULT 0;
+
+ALTER TABLE compliance_tom_measures
+    ADD COLUMN IF NOT EXISTS current_version INTEGER DEFAULT 0;
+
+ALTER TABLE compliance_loeschfristen
+    ADD COLUMN IF NOT EXISTS current_version INTEGER DEFAULT 0;
+
+ALTER TABLE compliance_obligations
+    ADD COLUMN IF NOT EXISTS current_version INTEGER DEFAULT 0;
+
+-- ============================================================================
+-- 2. DSFA Versions
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS compliance_dsfa_versions (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    dsfa_id UUID NOT NULL,
+    tenant_id VARCHAR(255) NOT NULL,
+    version_number INTEGER NOT NULL,
+    status VARCHAR(20) DEFAULT 'draft',
+    snapshot JSONB NOT NULL,
+    change_summary TEXT,
+    changed_sections JSONB DEFAULT '[]'::jsonb,
+    created_by VARCHAR(200) DEFAULT 'system',
+    approved_by VARCHAR(200),
+    approved_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    UNIQUE (dsfa_id, version_number)
+);
+
+CREATE INDEX IF NOT EXISTS idx_dsfa_versions_dsfa ON compliance_dsfa_versions(dsfa_id);
+CREATE INDEX IF NOT EXISTS idx_dsfa_versions_tenant ON compliance_dsfa_versions(tenant_id);
+
+-- ============================================================================
+-- 3. VVT Activity Versions
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS compliance_vvt_activity_versions (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    activity_id UUID NOT NULL,
+    tenant_id VARCHAR(255) NOT NULL,
+    version_number INTEGER NOT NULL,
+    status VARCHAR(20) DEFAULT 'draft',
+    snapshot JSONB NOT NULL,
+    change_summary TEXT,
+    changed_sections JSONB DEFAULT '[]'::jsonb,
+    created_by VARCHAR(200) DEFAULT 'system',
+    approved_by VARCHAR(200),
+    approved_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    UNIQUE (activity_id, version_number)
+);
+
+CREATE INDEX IF NOT EXISTS idx_vvt_activity_versions_activity ON compliance_vvt_activity_versions(activity_id);
+CREATE INDEX IF NOT EXISTS idx_vvt_activity_versions_tenant ON compliance_vvt_activity_versions(tenant_id);
+
+-- ============================================================================
+-- 4. TOM Versions
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS compliance_tom_versions (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    measure_id UUID NOT NULL,
+    tenant_id VARCHAR(255) NOT NULL,
+    version_number INTEGER NOT NULL,
+    status VARCHAR(20) DEFAULT 'draft',
+    snapshot JSONB NOT NULL,
+    change_summary TEXT,
+    changed_sections JSONB DEFAULT '[]'::jsonb,
+    created_by VARCHAR(200) DEFAULT 'system',
+    approved_by VARCHAR(200),
+    approved_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    UNIQUE (measure_id, version_number)
+);
+
+CREATE INDEX IF NOT EXISTS idx_tom_versions_measure ON compliance_tom_versions(measure_id);
+CREATE INDEX IF NOT EXISTS idx_tom_versions_tenant ON compliance_tom_versions(tenant_id);
+
+-- ============================================================================
+-- 5. Loeschfristen Versions
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS compliance_loeschfristen_versions (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    policy_id UUID NOT NULL,
+    tenant_id VARCHAR(255) NOT NULL,
+    version_number INTEGER NOT NULL,
+    status VARCHAR(20) DEFAULT 'draft',
+    snapshot JSONB NOT NULL,
+    change_summary TEXT,
+    changed_sections JSONB DEFAULT '[]'::jsonb,
+    created_by VARCHAR(200) DEFAULT 'system',
+    approved_by VARCHAR(200),
+    approved_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    UNIQUE (policy_id, version_number)
+);
+
+CREATE INDEX IF NOT EXISTS idx_loeschfristen_versions_policy ON compliance_loeschfristen_versions(policy_id);
+CREATE INDEX IF NOT EXISTS idx_loeschfristen_versions_tenant ON compliance_loeschfristen_versions(tenant_id);
+
+-- ============================================================================
+-- 6. Obligation Versions
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS compliance_obligation_versions (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    obligation_id UUID NOT NULL,
+    tenant_id VARCHAR(255) NOT NULL,
+    version_number INTEGER NOT NULL,
+    status VARCHAR(20) DEFAULT 'draft',
+    snapshot JSONB NOT NULL,
+    change_summary TEXT,
+    changed_sections JSONB DEFAULT '[]'::jsonb,
+    created_by VARCHAR(200) DEFAULT 'system',
+    approved_by VARCHAR(200),
+    approved_at TIMESTAMPTZ,
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    UNIQUE (obligation_id, version_number)
+);
+
+CREATE INDEX IF NOT EXISTS idx_obligation_versions_obligation ON compliance_obligation_versions(obligation_id);
+CREATE INDEX IF NOT EXISTS idx_obligation_versions_tenant ON compliance_obligation_versions(tenant_id);
+
+COMMIT;

backend-compliance/migrations/038_change_requests.sql

@@ -0,0 +1,64 @@
+-- Migration 038: Change-Request System
+-- Central inbox for compliance changes triggered by events or manual creation
+
+BEGIN;
+
+-- ============================================================================
+-- 1. Change Requests Table
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS compliance_change_requests (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id VARCHAR(255) NOT NULL,
+    -- Trigger source
+    trigger_type VARCHAR(50) NOT NULL DEFAULT 'manual',
+    trigger_source_id UUID,
+    -- Target document
+    target_document_type VARCHAR(50) NOT NULL,
+    target_document_id UUID,
+    target_section VARCHAR(100),
+    -- Proposal
+    proposal_title VARCHAR(500) NOT NULL,
+    proposal_body TEXT,
+    proposed_changes JSONB DEFAULT '{}'::jsonb,
+    -- Workflow
+    status VARCHAR(30) NOT NULL DEFAULT 'pending',
+    priority VARCHAR(20) DEFAULT 'normal',
+    decided_by VARCHAR(200),
+    decided_at TIMESTAMPTZ,
+    rejection_reason TEXT,
+    resulting_version_id UUID,
+    -- Soft delete
+    is_deleted BOOLEAN DEFAULT FALSE,
+    -- Metadata
+    created_by VARCHAR(200) DEFAULT 'system',
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    updated_at TIMESTAMPTZ DEFAULT NOW(),
+    CONSTRAINT chk_cr_status CHECK (status IN ('pending', 'accepted', 'rejected', 'edited_and_accepted')),
+    CONSTRAINT chk_cr_priority CHECK (priority IN ('low', 'normal', 'high', 'critical')),
+    CONSTRAINT chk_cr_doc_type CHECK (target_document_type IN ('dsfa', 'vvt', 'tom', 'loeschfristen', 'obligation'))
+);
+
+CREATE INDEX IF NOT EXISTS idx_cr_tenant ON compliance_change_requests(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_cr_status ON compliance_change_requests(tenant_id, status) WHERE NOT is_deleted;
+CREATE INDEX IF NOT EXISTS idx_cr_doc_type ON compliance_change_requests(tenant_id, target_document_type) WHERE NOT is_deleted;
+CREATE INDEX IF NOT EXISTS idx_cr_priority ON compliance_change_requests(tenant_id, priority) WHERE status = 'pending' AND NOT is_deleted;
+
+-- ============================================================================
+-- 2. Audit Log for Change Requests
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS compliance_change_request_audit (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    change_request_id UUID NOT NULL REFERENCES compliance_change_requests(id) ON DELETE CASCADE,
+    tenant_id VARCHAR(255) NOT NULL,
+    action VARCHAR(50) NOT NULL,
+    performed_by VARCHAR(200) DEFAULT 'system',
+    before_state JSONB,
+    after_state JSONB,
+    created_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_cra_cr ON compliance_change_request_audit(change_request_id);
+
+COMMIT;