fix(cra): Scanner-Findings vollstaendig mappen + assess-from-scanner-Latenz senken

Punkt 2 (Coverage): semgrep/gdpr-Findings ohne CWE blieben unmapped (~21%).
Der Mapper nutzt jetzt den scanner rule_id + gezielte Keywords (gdpr ->
Datenminimierung CRA-AI-17, path-traversal/prototype-pollution -> CRA-AI-20,
nginx-header/Docker-Hardening -> CRA-AI-1/4, insecure-websocket -> CRA-AI-15).
Reale Scanner-Daten: unmapped 19/92 -> 0/92 (Coverage 100%).

Punkt 3 (Latenz): enrich_findings_with_breadth lief ~6 Aggregat-Queries je
(use_case,sub_topic)-Paar, nutzte aber nur die Liste. Jetzt EINE batched Query
(breadth_controls_batch) fuer alle Paare + Prozess-Cache (TTL 1800s). macmini:
cold 0,23s / warm 0,000s. Prod-Root-Cause: atom_classification ohne
(use_case,sub_topic)-Index nach DB-Swap -> Index dem DB-Owner empfohlen.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend-compliance/tests/test_cra_finding_mapper.py

@@ -56,6 +56,39 @@ def test_unmapped_finding_is_flagged_not_invented():
     assert m.requirement_ids == []
 
 
+def test_gdpr_scanner_finding_maps_to_data_minimisation():
+    # gdpr-pattern scanner finding (no cwe) -> CRA Annex I data minimisation
+    m = map_finding(ScannerFinding(
+        id="g1", category="gdpr", title="Data collection without apparent consent mechanism",
+        severity="medium"))
+    assert m.primary_requirement == "CRA-AI-17"
+    assert not m.unmapped
+
+
+def test_semgrep_path_traversal_via_rule_id_maps_to_secure_testing():
+    # semgrep finding with NO cwe — the rule_id pins it as path traversal
+    m = map_finding(ScannerFinding(
+        id="s1", category="sast", rule_id="javascript.express.security.express-path-join-resolve",
+        title="Possible writing outside of the destination", severity="medium"))
+    assert m.primary_requirement == "CRA-AI-20"
+    assert not m.unmapped
+
+
+def test_semgrep_prototype_pollution_maps_to_secure_testing():
+    m = map_finding(ScannerFinding(
+        id="s2", category="sast", title="Possibility of prototype polluting function detected",
+        severity="medium"))
+    assert m.primary_requirement == "CRA-AI-20"
+
+
+def test_nginx_header_redefinition_maps_to_secure_config():
+    m = map_finding(ScannerFinding(
+        id="s3", category="sast", rule_id="generic.nginx.security.header-redefinition",
+        title="The 'add_header' directive is called in a 'location' block", severity="medium"))
+    assert m.primary_requirement == "CRA-AI-1"
+    assert not m.unmapped
+
+
 def test_assessment_aggregates_and_coverage():
     findings = [
         ScannerFinding(id="a", cwe="CWE-259", severity="critical"),     # CRA-AI-8