feat(iace): wire OSHA minimum-distance library into measures + endpoint

The May-built OSHA distance library (minimum_distances.go, 29 CFR 1910,
US public domain) was dead code — zero callers, no route, no test, while
the mm values that actually appear in measures are independent hand-prose
(some carrying ISO 13854/13857 values, not OSHA).

This surfaces it without touching the measures response contract:
- GET /iace/minimum-distances (+ ?measure_id=) returns the distances, the
  curated measure→distance link table and the licensing note.
- AllMeasureDistanceLinks/MinimumDistancesForMeasure resolve only the
  defensible links (M600 value_source; M254/M065 public-domain crossref to
  ISO), with the relation made explicit so the join stays honest.
- architecture.go lists the OSHA library so it shows in the audit explainer.
- Tests: inch→mm conversion + license completeness, link integrity, and a
  consistency test pinning that a value_source measure's prose still
  matches the OSHA source (codifies the audit finding as a regression gate).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ai-compliance-sdk/internal/app/routes_iace.go

@@ -30,6 +30,7 @@ func registerIACERoutes(v1 *gin.RouterGroup, h *handlers.IACEHandler) {
 		iaceRoutes.GET("/operational-states", h.ListOperationalStates)
 		iaceRoutes.GET("/component-library", h.ListComponentLibrary)
 		iaceRoutes.GET("/energy-sources", h.ListEnergySources)
+		iaceRoutes.GET("/minimum-distances", h.ListMinimumDistances)
 		iaceRoutes.GET("/tags", h.ListTags)
 		iaceRoutes.GET("/hazard-patterns", h.ListHazardPatterns)