feat(regulations): Automatische Ableitung anwendbarer Gesetze & Aufsichtsbehoerden

Nach Abschluss von Profil + Scope werden jetzt automatisch die anwendbaren
Regulierungen (DSGVO, NIS2, AI Act, DORA) ermittelt und die zustaendigen
Aufsichtsbehoerden (Landes-DSB, BSI, BaFin) aus Bundesland + Branche abgeleitet.

- Neues scope-to-facts.ts: Mapping CompanyProfile+Scope → Go SDK Payload
- Neues supervisory-authority-resolver.ts: 16 Landes-DSB + nationale Behoerden
- ScopeDecisionTab: Regulierungs-Report mit Aufsichtsbehoerden-Karten
- Obligations-Seite: Echte Daten statt Dummy in handleAutoProfiling()
- Neue Types: ApplicableRegulation, RegulationAssessmentResult, SupervisoryAuthorityInfo

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

admin-compliance/app/sdk/obligations/page.tsx

@@ -4,6 +4,9 @@ import React, { useState, useEffect, useCallback } from 'react'
 import { StepHeader, STEP_EXPLANATIONS } from '@/components/sdk/StepHeader'
 import TOMControlPanel from '@/components/sdk/obligations/TOMControlPanel'
 import GapAnalysisView from '@/components/sdk/obligations/GapAnalysisView'
+import { useSDK } from '@/lib/sdk'
+import { buildAssessmentPayload } from '@/lib/sdk/scope-to-facts'
+import type { ApplicableRegulation } from '@/lib/sdk/compliance-scope-types'
 
 // =============================================================================
 // Types
@@ -545,6 +548,7 @@ const REGULATION_CHIPS = [
 const UCCA_API = '/api/sdk/v1/ucca/obligations'
 
 export default function ObligationsPage() {
+  const { state: sdkState } = useSDK()
   const [obligations, setObligations] = useState<Obligation[]>([])
   const [stats, setStats] = useState<ObligationStats | null>(null)
   const [filter, setFilter] = useState('all')
@@ -557,6 +561,7 @@ export default function ObligationsPage() {
   const [detailObligation, setDetailObligation] = useState<Obligation | null>(null)
   const [showGapAnalysis, setShowGapAnalysis] = useState(false)
   const [profiling, setProfiling] = useState(false)
+  const [applicableRegs, setApplicableRegs] = useState<ApplicableRegulation[]>([])
 
   const loadData = useCallback(async () => {
     setLoading(true)
@@ -667,26 +672,44 @@ export default function ObligationsPage() {
     setProfiling(true)
     setError(null)
     try {
-      const res = await fetch(`${UCCA_API}/assess-from-scope`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
+      // Build payload from real CompanyProfile + Scope data
+      const profile = sdkState.companyProfile
+      const scopeState = sdkState.complianceScope
+      const scopeAnswers = scopeState?.answers || []
+      const scopeDecision = scopeState?.decision || null
+
+      let payload: Record<string, unknown>
+      if (profile) {
+        payload = buildAssessmentPayload(profile, scopeAnswers, scopeDecision) as unknown as Record<string, unknown>
+      } else {
+        // Fallback: Minimaldaten wenn kein Profil vorhanden
+        payload = {
           employee_count: 50,
           industry: 'technology',
+          country: 'DE',
           processes_personal_data: true,
           is_controller: true,
           uses_processors: true,
-          processes_special_categories: false,
-          cross_border_transfer: true,
-          uses_ai: true,
-          determined_level: 'L2',
-        }),
+          determined_level: scopeDecision?.determinedLevel || 'L2',
+        }
+      }
+
+      const res = await fetch(`${UCCA_API}/assess-from-scope`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload),
       })
       if (!res.ok) throw new Error(`HTTP ${res.status}`)
       const data = await res.json()
-      if (data.obligations?.length > 0) {
-        // Merge auto-profiled obligations into the view
-        const autoObls: Obligation[] = data.obligations.map((o: Record<string, unknown>) => ({
+
+      // Store applicable regulations for the info box
+      const regs: ApplicableRegulation[] = data.overview?.applicable_regulations || data.applicable_regulations || []
+      setApplicableRegs(regs)
+
+      // Extract obligations from response (can be nested under overview)
+      const rawObls = data.overview?.obligations || data.obligations || []
+      if (rawObls.length > 0) {
+        const autoObls: Obligation[] = rawObls.map((o: Record<string, unknown>) => ({
           id: o.id as string,
           title: o.title as string,
           description: (o.description as string) || '',
@@ -818,6 +841,36 @@ export default function ObligationsPage() {
         <div className="bg-amber-50 border border-amber-200 rounded-lg p-3 text-sm text-amber-700">{error}</div>
       )}
 
+      {/* Applicable Regulations Info */}
+      {applicableRegs.length > 0 && (
+        <div className="bg-blue-50 border border-blue-200 rounded-xl p-4">
+          <h3 className="text-sm font-semibold text-blue-900 mb-2">Anwendbare Regulierungen (aus Auto-Profiling)</h3>
+          <div className="flex flex-wrap gap-2">
+            {applicableRegs.map(reg => (
+              <span
+                key={reg.id}
+                className="inline-flex items-center gap-1.5 px-3 py-1 rounded-full text-xs font-medium bg-white border border-blue-300 text-blue-800"
+              >
+                <svg className="w-3.5 h-3.5 text-green-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M5 13l4 4L19 7" />
+                </svg>
+                {reg.name}
+                {reg.classification && <span className="text-blue-500">({reg.classification})</span>}
+                <span className="text-blue-400">{reg.obligation_count} Pflichten</span>
+              </span>
+            ))}
+          </div>
+        </div>
+      )}
+
+      {/* No Profile Warning */}
+      {!sdkState.companyProfile && (
+        <div className="bg-yellow-50 border border-yellow-200 rounded-lg p-3 text-sm text-yellow-700">
+          Kein Unternehmensprofil vorhanden. Auto-Profiling verwendet Beispieldaten.{' '}
+          <a href="/sdk/company-profile" className="underline font-medium">Profil anlegen →</a>
+        </div>
+      )}
+
       {/* Stats */}
       <div className="grid grid-cols-2 md:grid-cols-4 gap-4">
         {[