feat: Phase 9 — Authenticated Testing + Legal Basis Validator (lit. mapping)

Phase 9: Playwright login + 5 post-login checks:
- §312k BGB: Kündigungsbutton (2 Klicks)
- Art. 17 DSGVO: Konto löschen
- Art. 20 DSGVO: Daten exportieren
- Art. 7(3): Einwilligungen widerrufen
- Art. 15: Profildaten einsehen
Auto-detects login form selectors. Credentials destroyed after test.

Legal Basis Validator: Checks 7 common lit-mapping mistakes:
- Cookie tracking on lit. f instead of lit. a (Planet49)
- Analytics on lit. b (contract overextension)
- Klarna without Art. 22 reference
- Session recording without consent
Integrated into website scan pipeline.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/api/agent_scan_routes.py

@@ -21,6 +21,7 @@ from compliance.services.dse_matcher import build_text_references, TextReference
 from compliance.services.mandatory_content_checker import (
     check_mandatory_documents, check_dse_mandatory_content, MandatoryFinding,
 )
+from compliance.services.legal_basis_validator import validate_legal_bases
 
 logger = logging.getLogger(__name__)
 
@@ -132,6 +133,22 @@ async def scan_website_endpoint(req: ScanRequest):
             text=f"{mf.text}" + (f" — {mf.suggestion}" if mf.suggestion else ""),
         ))
 
+    # Step 8b: Validate legal bases (lit. a-f) in DSE
+    if dse_text:
+        lit_findings = validate_legal_bases(dse_text)
+        for lf in lit_findings:
+            findings.append(ScanFinding(
+                code=f"LIT-{lf.purpose.upper()}",
+                severity=lf.severity,
+                text=lf.text,
+                text_reference=TextReferenceModel(
+                    found=True, source_url=req.url,
+                    original_text=lf.original_text,
+                    issue="incorrect", correction_type="replace",
+                    correction_text=f"Korrekte Rechtsgrundlage: {lf.correct_basis} ({lf.legal_ref})",
+                ) if lf.original_text else None,
+            ))
+
     # Step 9: Generate corrections for pre-launch mode
     if not is_live and findings:
         await _add_corrections(findings, dse_text)