feat: Control Library UI, dedup migration, QA tooling, docs

- Control Library: parent control display, ObligationTypeBadge,
  GenerationStrategyBadge variants, evidence string fallback
- API: expose parent_control_uuid/id/title in canonical controls
- Fix: DSFA SQLAlchemy 2.0 Row._mapping compatibility
- Migration 074: control_parent_links + control_dedup_reviews tables
- QA scripts: benchmark, gap analysis, OSCAL import, OWASP cleanup,
  phase5 normalize, phase74 gap fill, sync_db, run_job
- Docs: dedup engine, RAG benchmark, lessons learned, pipeline docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/tests/test_canonical_control_routes.py

@@ -195,6 +195,11 @@ class TestControlRowConversion:
             "release_state": "draft",
             "tags": ["mfa"],
             "generation_strategy": "ungrouped",
+            "parent_control_uuid": None,
+            "parent_control_id": None,
+            "parent_control_title": None,
+            "decomposition_method": None,
+            "pipeline_version": None,
             "created_at": now,
             "updated_at": now,
         }