feat(iace): FMEA source-document register + Anthropic extraction (Haiku)

Quote-verifiable failure extraction via Claude (Haiku 4.5): PDF sent
directly, tool-schema forces verbatim source quotes + applicable flag +
confidence — replaces the unreliable local llama run. Only applicable=true
tuples ingest into bp_iace_failure_kb; every processed doc lands in the
source manifest.

Frontend: FMEA tab now shows a "Quelldokumente" register (every document we
use, with source + licence + link + what was extracted) served from the
embedded manifest via GET /iace/failure-knowledge/sources. Manifest is
placeholder until the 100-doc Haiku run is folded in.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ai-compliance-sdk/internal/api/handlers/iace_handler_failure.go

@@ -29,6 +29,14 @@ func (h *IACEHandler) ListFailureKnowledge(c *gin.Context) {
 	})
 }
 
+// ListFailureSources handles GET /failure-knowledge/sources.
+// The source-document register for the FMEA frontend: EVERY document we use,
+// with its source + licence + URL (and what was extracted). Always visible so an
+// auditor sees the full provenance of the failure-knowledge corpus.
+func (h *IACEHandler) ListFailureSources(c *gin.Context) {
+	c.JSON(http.StatusOK, iace.GetFailureSources())
+}
+
 // HarvestNTRSFailures handles GET /failure-knowledge/ntrs.
 // Live-harvests NASA NTRS lessons-learned metadata and returns only the records
 // that pass the public-reuse licence gate (Stage 1 of the bulk loader). Tuple