feat(iace): DSMS-CID-Badge im Tech-File-Export + aggregierter Bulk-Diff

Punkt 1 — UI-CID-Badge nach erfolgreichem Tech-File-Export:
- archiveTechFile setzt X-DSMS-CID / X-DSMS-Filename / X-DSMS-Size response
  headers + Access-Control-Expose-Headers, sobald DSMS-Archive durchlief
- Split iace_handler_techfile.go (war ueber 500 LOC) → archiveTechFile lebt
  jetzt in iace_handler_techfile_archive.go, setDSMSResponseHeaders als
  pure Helper mit 3 unit tests
- Next.js IACE-Proxy forwarded die X-DSMS-* Header und erkennt jetzt auch
  XLSX/DOCX/MD als Binary-Response (vorher nur PDF/ZIP/octet-stream)
- ExportCIDBadge.tsx zeigt CID, Filename, Groesse + Kopieren-Button +
  "Verlauf anzeigen" (oeffnet CIDHistoryModal)

Punkt 2 — Bulk-Diff Report V1 → V_latest:
- Neuer Endpoint GET /api/v1/documents/{cid}/bulk-diff im dsms-gateway:
  laeuft parent_cid-Kette ab, berechnet chronologische Step-Diffs,
  aggregiert Totals (added/removed lines, metadata_fields_changed,
  binary_steps). Edge-Cases: einzelne Version, binaere Steps, abgebrochene
  Kette
- BulkDiffPanel.tsx zeigt 4-Stat-Header + Step-Tabelle
- CIDHistoryModal bekommt Toggle-Button "Bulk-Diff V1 → V_latest anzeigen"
  neben dem Versions-Counter; damit auch vom IACE-Export-Badge erreichbar

Tests: 3 neue Go-Tests, 4 neue pytest-Tests, alle gruen

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

admin-compliance/app/api/sdk/v1/iace/[[...path]]/route.ts

@@ -66,18 +66,31 @@ async function proxyRequest(
 
     const response = await fetch(url, fetchOptions)
 
-    // Handle non-JSON responses (PDF exports, ZIP CE technical file)
-    const responseContentType = response.headers.get('content-type')
-    if (responseContentType?.includes('application/pdf') ||
-        responseContentType?.includes('application/zip') ||
-        responseContentType?.includes('application/octet-stream')) {
+    // Handle non-JSON responses (PDF/ZIP CE technical file, XLSX/DOCX/MD exports).
+    const responseContentType = response.headers.get('content-type') || ''
+    const isBinary =
+      responseContentType.includes('application/pdf') ||
+      responseContentType.includes('application/zip') ||
+      responseContentType.includes('application/octet-stream') ||
+      responseContentType.includes('application/vnd.openxmlformats-officedocument') ||
+      responseContentType.includes('application/vnd.ms-excel') ||
+      responseContentType.includes('application/msword') ||
+      responseContentType.includes('text/markdown')
+    if (isBinary) {
       const blob = await response.blob()
+      const forwardedHeaders: Record<string, string> = {
+        'Content-Type': responseContentType,
+        'Content-Disposition': response.headers.get('content-disposition') || '',
+      }
+      // Forward DSMS archive metadata so the frontend can render the CID badge
+      // (set by archiveTechFile when the backend persisted the export to DSMS).
+      for (const h of ['x-dsms-cid', 'x-dsms-filename', 'x-dsms-size']) {
+        const v = response.headers.get(h)
+        if (v) forwardedHeaders[h] = v
+      }
       return new NextResponse(blob, {
         status: response.status,
-        headers: {
-          'Content-Type': responseContentType,
-          'Content-Disposition': response.headers.get('content-disposition') || '',
-        },
+        headers: forwardedHeaders,
       })
     }