feat(iace): DSMS-CID-Badge im Tech-File-Export + aggregierter Bulk-Diff

Punkt 1 — UI-CID-Badge nach erfolgreichem Tech-File-Export:
- archiveTechFile setzt X-DSMS-CID / X-DSMS-Filename / X-DSMS-Size response
  headers + Access-Control-Expose-Headers, sobald DSMS-Archive durchlief
- Split iace_handler_techfile.go (war ueber 500 LOC) → archiveTechFile lebt
  jetzt in iace_handler_techfile_archive.go, setDSMSResponseHeaders als
  pure Helper mit 3 unit tests
- Next.js IACE-Proxy forwarded die X-DSMS-* Header und erkennt jetzt auch
  XLSX/DOCX/MD als Binary-Response (vorher nur PDF/ZIP/octet-stream)
- ExportCIDBadge.tsx zeigt CID, Filename, Groesse + Kopieren-Button +
  "Verlauf anzeigen" (oeffnet CIDHistoryModal)

Punkt 2 — Bulk-Diff Report V1 → V_latest:
- Neuer Endpoint GET /api/v1/documents/{cid}/bulk-diff im dsms-gateway:
  laeuft parent_cid-Kette ab, berechnet chronologische Step-Diffs,
  aggregiert Totals (added/removed lines, metadata_fields_changed,
  binary_steps). Edge-Cases: einzelne Version, binaere Steps, abgebrochene
  Kette
- BulkDiffPanel.tsx zeigt 4-Stat-Header + Step-Tabelle
- CIDHistoryModal bekommt Toggle-Button "Bulk-Diff V1 → V_latest anzeigen"
  neben dem Versions-Counter; damit auch vom IACE-Export-Badge erreichbar

Tests: 3 neue Go-Tests, 4 neue pytest-Tests, alle gruen

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ai-compliance-sdk/internal/api/handlers/iace_handler_techfile.go

@@ -1,12 +1,10 @@
 package handlers
 
 import (
-	"encoding/json"
 	"fmt"
 	"net/http"
 	"strings"
 
-	"github.com/breakpilot/ai-compliance-sdk/internal/dsms"
 	"github.com/breakpilot/ai-compliance-sdk/internal/iace"
 	"github.com/breakpilot/ai-compliance-sdk/internal/rbac"
 	"github.com/gin-gonic/gin"
@@ -367,7 +365,10 @@ func (h *IACEHandler) ApproveTechFileSection(c *gin.Context) {
 }
 
 // ExportTechFile handles GET /projects/:id/tech-file/export?format=pdf|xlsx|docx|md|json
-// Exports all tech file sections in the requested format.
+// Exports all tech file sections in the requested format. When the archive
+// succeeds, archiveTechFile (in iace_handler_techfile_archive.go) attaches
+// X-DSMS-* response headers carrying the resulting CID so the frontend can
+// render an inline CID-badge in the export-success path.
 func (h *IACEHandler) ExportTechFile(c *gin.Context) {
 	projectID, err := uuid.Parse(c.Param("id"))
 	if err != nil {
@@ -468,31 +469,3 @@ func (h *IACEHandler) ExportTechFile(c *gin.Context) {
 		})
 	}
 }
-
-// archiveTechFile stores a tech-file export to DSMS (best-effort, non-blocking)
-// AND records the resulting CID in the IACE audit trail so the export is
-// traceable. The "new_values" JSON carries the CID + filename so the audit
-// timeline can later resolve the CID against the DSMS gateway for verify.
-func (h *IACEHandler) archiveTechFile(c *gin.Context, data []byte, filename string, projectID uuid.UUID) {
-	result := dsms.Archive(data, filename, "ce_techfile", projectID.String(), "1")
-	if result == nil || result.CID == "" {
-		return
-	}
-	payload := map[string]string{
-		"cid":      result.CID,
-		"filename": filename,
-		"size":     fmt.Sprintf("%d", result.Size),
-	}
-	newValues, _ := json.Marshal(payload)
-	userID := rbac.GetUserID(c)
-	_ = h.store.AddAuditEntry(
-		c.Request.Context(),
-		projectID,
-		"tech_file_export",
-		projectID,
-		iace.AuditActionCreate,
-		userID.String(),
-		nil,
-		newValues,
-	)
-}