feat(ai-sdk): keep cyber/AI hazards out of the traditional CE hazard log

InitializeProject created hazards for every matched pattern, so native
cybersecurity/AI topics (unauthorized access, firmware manipulation, missing
SBOM, ...) mixed into the ISO 12100 hazard log. Route the security categories
(frontend groups I. Cyber/Netzwerk + J. KI) to the CRA module instead —
generically for EVERY project, enforced centrally in InitializeProject.

The split is by the nature of the hazard, not the component: functional-safety
control faults stay in CE (software faults, lost safety functions, config
errors, bus failures, botched updates) — they are random/systematic faults,
not attacks, and feed the CRA safety-function bridge. This holds whether the
controller is a bought-in CE-marked PLC or the manufacturer's own control.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ai-compliance-sdk/internal/api/handlers/iace_handler_init.go

@@ -211,6 +211,13 @@ func (h *IACEHandler) InitializeProject(c *gin.Context) {
 			}
 
 			for _, cat := range mp.HazardCats {
+				// Native cyber/AI categories (frontend groups I+J) belong to the
+				// CRA module, not the traditional CE (ISO 12100) hazard log.
+				// Enforced centrally here so it holds for EVERY project.
+				if isCyberSecurityCategory(cat) {
+					fmt.Printf("CYBER-SKIP: cat=%s pattern=%s — routed to CRA module\n", cat, mp.PatternID)
+					continue
+				}
 				maxForCat := categoryHazardCap(cat, len(comps))
 				if catCount[cat] >= maxForCat {
 					continue