feat(iace): FMEA source-document register + Anthropic extraction (Haiku)

Quote-verifiable failure extraction via Claude (Haiku 4.5): PDF sent
directly, tool-schema forces verbatim source quotes + applicable flag +
confidence — replaces the unreliable local llama run. Only applicable=true
tuples ingest into bp_iace_failure_kb; every processed doc lands in the
source manifest.

Frontend: FMEA tab now shows a "Quelldokumente" register (every document we
use, with source + licence + link + what was extracted) served from the
embedded manifest via GET /iace/failure-knowledge/sources. Manifest is
placeholder until the 100-doc Haiku run is folded in.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ai-compliance-sdk/internal/iace/failure_sources_test.go

@@ -0,0 +1,20 @@
+package iace
+
+import "testing"
+
+// The embedded manifest must always parse and every document must carry a
+// source + licence (the register is the auditable provenance shown in the UI).
+func TestGetFailureSources_ParsesAndAttributed(t *testing.T) {
+	fs := GetFailureSources()
+	if fs.Documents == nil {
+		t.Fatal("documents must never be nil")
+	}
+	for _, d := range fs.Documents {
+		if d.Source == "" || d.License == "" {
+			t.Errorf("doc %d missing source/license: %+v", d.ID, d)
+		}
+		if !FailureKnowledgeLicenseAllowed(d.License) {
+			t.Errorf("doc %d carries a non-allowed licence %q", d.ID, d.License)
+		}
+	}
+}