feat(cra): scanner-repo→IACE-Projekt-Mapping persistieren (Pull-Flow) [migration-approved]

Ersetzt die ephemere Dropdown-Auswahl durch DB-Persistenz pro IACE-Projekt:
- Migration 156: compliance_cra_scanner_repo_map (tenant_id, iace_project_id PK,
  scanner_repo_id). Additiv + idempotent.
- GET/PUT /v1/cra/scanner-repo-map/{iace_project_id} (Upsert/Clear).
- useCRA lädt das gespeicherte Repo beim Laden + persistiert bei Auswahl.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

admin-compliance/app/sdk/iace/[projectId]/cra/_hooks/useCRA.ts

@@ -89,7 +89,7 @@ function merge(live: any): CRADemo {
 export function useCRA(projectId?: string) {
   const [data, setData] = useState<CRADemo | null>(null)
   const [live, setLive] = useState(false)
-  const [scannerRepo, setScannerRepo] = useState('')   // pull-flow: chosen scanner repo_id
+  const [scannerRepo, setScannerRepoState] = useState('')   // pull-flow: chosen scanner repo_id
   const [weights, setWeights] = useState<Weights>({})
   const [snapshots, setSnapshots] = useState<SnapshotMeta[]>([])
 
@@ -171,5 +171,25 @@ export function useCRA(projectId?: string) {
     return r.ok ? r.json() : null
   }, [])
 
+  // Pull-flow mapping: load the persisted scanner repo for this IACE project,
+  // and persist it on change (replaces the old ephemeral dropdown state).
+  useEffect(() => {
+    if (!projectId) return
+    fetch(`/api/v1/cra/scanner-repo-map/${projectId}`)
+      .then((r) => (r.ok ? r.json() : null))
+      .then((j) => { if (j?.scanner_repo_id) setScannerRepoState(j.scanner_repo_id) })
+      .catch(() => {})
+  }, [projectId])
+
+  const setScannerRepo = useCallback((v: string) => {
+    setScannerRepoState(v)
+    if (projectId) {
+      fetch(`/api/v1/cra/scanner-repo-map/${projectId}`, {
+        method: 'PUT', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ scanner_repo_id: v }),
+      }).catch(() => {})
+    }
+  }, [projectId])
+
   return { data, live, weights, setWeights, snapshots, saveSnapshot, viewSnapshot, scannerRepo, setScannerRepo }
 }