feat(cra): SBOM- + DAST-Findings aus dem Scanner-MCP konsumieren

Sharangs compliance-scanner-agent exponiert SBOM (sbom_vuln_report) + DAST
(list_dast_findings) als eigene MCP-Tools (nicht via list_findings). Neuer
fetch_all_findings(repo_id) zieht list_findings + SBOM + DAST in EINER
MCP-Session und normalisiert ins Finding-Schema:
- SBOM: ein Finding pro verwundbarem Paket (nicht pro CVE), cwe=CWE-1395
  -> deterministisch CRA-AI-22 (robust gegen Paketnamen wie "sqlite").
- DAST: cwe/endpoint/vuln_type uebernommen -> Mapping via cwe/keywords.
assess-from-scanner nutzt fetch_all_findings + liefert source.breakdown
(code/sbom/dast). DAST hat im MCP keinen repo_id-Filter -> dast_repo_scoped:false
(deployment-weit, transparent geflaggt).

Echte MCP-Daten: Kitchenasty 58 code + 35 sbom + 81 dast -> 174 gemappt
(Coverage 94,3%, alle 35 SBOM -> CRA-AI-22).

Enthaelt zusaetzlich das Qdrant->Prod-Kopierскript (#42, verbatim macmini->prod).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend-compliance/compliance/api/cra_assess_routes.py

@@ -21,7 +21,7 @@ from compliance.services.cra_applicability import (
     compute_verdict, compute_machinery_verdict, maturity as evidence_maturity, MACHINE_INTEGRATOR,
 )
 from compliance.services.cra_datasheet_extractor import extract_grenzen
-from compliance.services.scanner_mcp_client import fetch_findings
+from compliance.services.scanner_mcp_client import fetch_findings, fetch_all_findings
 from compliance.services.cra_snapshot_store import save_snapshot, list_snapshots, get_snapshot
 from compliance.services.cra_use_case_controls import enrich_findings_with_breadth
 from compliance.services.cra_component_findings import findings_from_components
@@ -121,10 +121,11 @@ async def assess_from_scanner(body: ScannerPullRequest):
     scan_type/cvss_score/file_path). Returns empty assessment if no scanner is
     configured — the frontend then keeps its demo scenario.
     """
-    findings = await fetch_findings(
+    pulled = await fetch_all_findings(
         repo_id=body.repo_id, severity=body.severity,
         base_url=body.scanner_url, token=body.token,
     )
+    findings = pulled.get("findings", [])
     payload = {
         "findings": findings,
         "weights": body.weights,
@@ -136,7 +137,8 @@ async def assess_from_scanner(body: ScannerPullRequest):
         enrich_findings_with_breadth(result.get("mapped", []), db)
     finally:
         db.close()
-    result["source"] = {"scanner": True, "pulled": len(findings)}
+    result["source"] = {"scanner": True, "pulled": len(findings),
+                        "breakdown": pulled.get("breakdown", {})}
     return result