fix(cra): Scanner-Findings vollstaendig mappen + assess-from-scanner-Latenz senken

Punkt 2 (Coverage): semgrep/gdpr-Findings ohne CWE blieben unmapped (~21%).
Der Mapper nutzt jetzt den scanner rule_id + gezielte Keywords (gdpr ->
Datenminimierung CRA-AI-17, path-traversal/prototype-pollution -> CRA-AI-20,
nginx-header/Docker-Hardening -> CRA-AI-1/4, insecure-websocket -> CRA-AI-15).
Reale Scanner-Daten: unmapped 19/92 -> 0/92 (Coverage 100%).

Punkt 3 (Latenz): enrich_findings_with_breadth lief ~6 Aggregat-Queries je
(use_case,sub_topic)-Paar, nutzte aber nur die Liste. Jetzt EINE batched Query
(breadth_controls_batch) fuer alle Paare + Prozess-Cache (TTL 1800s). macmini:
cold 0,23s / warm 0,000s. Prod-Root-Cause: atom_classification ohne
(use_case,sub_topic)-Index nach DB-Swap -> Index dem DB-Owner empfohlen.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend-compliance/tests/test_cra_use_case_controls.py

@@ -21,23 +21,29 @@ def test_every_requirement_maps_to_a_valid_subtopic():
 
 
 class _FakeControlsService:
-    """Stands in for UseCaseControlsService: returns one atom control per call,
-    carrying the legal anchor (source_article) the real atom query now selects."""
+    """Stands in for UseCaseControlsService: returns one atom control per
+    (use_case, sub_topic) pair, carrying the legal anchor (source_article) the
+    real batched atom query now selects."""
 
     def __init__(self, db):
         pass
 
-    def controls_for_use_case(self, use_case, sub_topic=None, limit=3):
-        return {"controls": [{
-            "control_id": "AI-{}-{}".format(use_case, sub_topic),
-            "title": "Test obligation",
-            "source_regulation": "Cyber Resilience Act (CRA)",
-            "source_article": "Artikel 13",
-            "severity": "high",
-        }]}
+    def breadth_controls_batch(self, pairs, per=3):
+        return {
+            (uc, st): [{
+                "control_id": "AI-{}-{}".format(uc, st),
+                "title": "Test obligation",
+                "source_regulation": "Cyber Resilience Act (CRA)",
+                "source_article": "Artikel 13",
+                "severity": "high",
+                "use_case": uc,
+            }]
+            for uc, st in pairs
+        }
 
 
 def test_breadth_carries_source_article(monkeypatch):
+    cra_use_case_controls._BREADTH_CACHE.clear()  # process cache — isolate the test
     monkeypatch.setattr(
         cra_use_case_controls, "UseCaseControlsService", _FakeControlsService,
     )