feat: 4 remaining tasks — EU institutions, banner integration, JS-sites, Caritas fixes

1. EU Institution Checks (Verordnung 2018/1725):
   - New doc_type "eu_institution" with 9 L1 + 15 L2 checks
   - Both German + English patterns (EU institutions are multilingual)
   - Auto-detection via "2018/1725", "EDSB", "EDPS" keywords
   - Correct article references (Art. 15 instead of 13, Art. 5 instead of 6)

2. Banner Check Integration:
   - banner_runner.py maps scan results to 36 L1/L2 structured checks
   - BannerCheckTab shows hierarchical ChecklistView with hints
   - 3-phase summary (cookies/scripts before/after consent)
   - /scan endpoint now includes structured_checks in response

3. JS-heavy Website Fixes (dm, Zalando, HWK):
   - dsi_helpers.py: goto_resilient (networkidle→domcontentloaded fallback)
   - try_dismiss_consent_banner before text extraction
   - PDF redirect detection (dm.de redirects to GCS PDF)

4. Caritas False Positive Fixes:
   - Phone regex allows parentheses: +49 (0)761 → now matches
   - "Recht auf Widerspruch" (3 words) + §23 KDG → matches Art. 21
   - Church authorities: "Katholisches Datenschutzzentrum" recognized

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/services/doc_checks/runner.py

@@ -15,6 +15,7 @@ from .impressum_checks import IMPRESSUM_CHECKLIST
 from .cookie_checks import COOKIE_CHECKLIST
 from .social_media_checks import JOINT_CONTROLLER_CHECKLIST
 from .dsfa_checks import DSFA_CHECKLIST
+from .eu_institution_checks import EU_INSTITUTION_CHECKLIST
 
 logger = logging.getLogger(__name__)
 
@@ -35,6 +36,7 @@ _CHECKLIST_MAP = {
     "social_media": (JOINT_CONTROLLER_CHECKLIST, "Art. 26 DSGVO"),
     "joint_controller": (JOINT_CONTROLLER_CHECKLIST, "Art. 26 DSGVO"),
     "dsfa": (DSFA_CHECKLIST, "Art. 35 DSGVO"),
+    "eu_institution": (EU_INSTITUTION_CHECKLIST, "VO (EU) 2018/1725"),
 }
 
 
@@ -218,6 +220,11 @@ def classify_document_type(title: str, url: str) -> str:
     if any(kw in combined for kw in ["social media", "facebook", "instagram", "linkedin", "fanpage"]):
         if any(kw in combined for kw in ["datenschutzerkl", "datenschutz für", "datenschutzinformation"]):
             return "social_media"
+    # EU institution check BEFORE generic privacy — 2018/1725 is more specific
+    if any(kw in combined for kw in ["2018/1725", "2018 1725", "regulation (eu)",
+                                       "verordnung (eu)", "edsb", "edps",
+                                       "european data protection supervisor"]):
+        return "eu_institution"
     if any(kw in combined for kw in ["datenschutz", "privacy", "dsgvo", "data protection", "données"]):
         return "dse"
     if any(kw in combined for kw in ["widerruf", "withdrawal", "rétractation", "desistimiento"]):