feat: Academy integration — training gap detection after document approval (F7)

- Migration 115: compliance_role_training_mapping table (org roles → training codes)
- TrainingLinkService: queries training_modules/matrix/assignments to find gaps
  per person and role. Gracefully degrades when Go training tables don't exist yet.
- document_review_routes: 2 new endpoints (training-requirements, training-gaps)
- _notify_approval() now checks training gaps and sends emails to persons
  with outstanding modules, linking to /sdk/training/learner

[migration-approved]

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/migrations/115_role_training_mapping.sql

@@ -0,0 +1,22 @@
+-- Migration 115: Mapping between organizational compliance roles and training role codes
+-- Bridges the Rollenkonzept (org_roles) with the Academy (training_matrix)
+
+CREATE TABLE IF NOT EXISTS compliance_role_training_mapping (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id VARCHAR(100) NOT NULL DEFAULT '__default__',
+    org_role_key VARCHAR(50) NOT NULL,
+    training_role_code VARCHAR(10) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE(tenant_id, org_role_key)
+);
+
+-- Seed default mapping
+INSERT INTO compliance_role_training_mapping (tenant_id, org_role_key, training_role_code) VALUES
+('__default__', 'dsb', 'R3'),
+('__default__', 'gf', 'R1'),
+('__default__', 'it_leiter', 'R2'),
+('__default__', 'hr_leitung', 'R5'),
+('__default__', 'einkauf', 'R6'),
+('__default__', 'compliance_beauftragter', 'R4'),
+('__default__', 'marketing_leitung', 'R7')
+ON CONFLICT DO NOTHING;