feat(cra): hard CRA<->IACE link — IACE tab pulls the linked assessment [migration-approved]

Migration 153 adds compliance_cra_projects.linked_iace_project_id (additive,
idempotent). New thin router cra_link_routes.py: POST /projects/{id}/link-iace
sets the reference; GET /by-iace/{iace_project_id} returns the linked CRA project
+ its latest assessment snapshot. The IACE "CRA / Cyber" tab now resolves the
linked CRA assessment first (real, from the snapshot) and only falls back to the
demo scenario when nothing is linked. One assessment, two views.

[migration-approved] — user approved the new column for the CRA<->IACE reference.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend-compliance/migrations/153_cra_linked_iace.sql

@@ -0,0 +1,10 @@
+-- Migration 153: CRA project -> IACE (CE risk assessment) project reference.
+-- One assessment, two views: the IACE "CRA / Cyber" tab resolves the linked CRA
+-- project's latest assessment snapshot via this column instead of a demo fixture.
+-- Additive + idempotent.
+
+ALTER TABLE compliance_cra_projects
+    ADD COLUMN IF NOT EXISTS linked_iace_project_id UUID;
+
+CREATE INDEX IF NOT EXISTS idx_cra_projects_linked_iace
+    ON compliance_cra_projects (linked_iace_project_id);