feat(gci): add Gesamt-Compliance-Index scoring engine and dashboard

Implements the 4-level GCI scoring model (Module -> Risk-Weighted -> Regulation Area -> Final GCI)
with DSGVO, NIS2, ISO 27001, and EU AI Act integration.

Backend:
- 9 Go files: engine, models, weights, validity, NIS2 roles/scoring, ISO mapping/gap-analysis, mock data
- GCI handlers with 13 API endpoints under /sdk/v1/gci/
- Routes registered in main.go

Frontend:
- TypeScript types, API client, Next.js API proxy
- Dashboard page with 6 tabs (Overview, Breakdown, NIS2, ISO 27001, Matrix, Audit Trail)
- Sidebar navigation entry

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ai-compliance-sdk/internal/gci/models.go

@@ -0,0 +1,104 @@
+package gci
+
+import "time"
+
+// Level 1: Module Score
+type ModuleScore struct {
+	ModuleID       string  `json:"module_id"`
+	ModuleName     string  `json:"module_name"`
+	Assigned       int     `json:"assigned"`
+	Completed      int     `json:"completed"`
+	RawScore       float64 `json:"raw_score"`       // completions/assigned
+	ValidityFactor float64 `json:"validity_factor"`  // 0.0-1.0
+	FinalScore     float64 `json:"final_score"`      // RawScore * ValidityFactor
+	RiskWeight     float64 `json:"risk_weight"`      // module criticality weight
+	Category       string  `json:"category"`         // dsgvo, nis2, iso27001, ai_act
+}
+
+// Level 2: Risk-weighted Module Score per regulation area
+type RiskWeightedScore struct {
+	AreaID       string        `json:"area_id"`
+	AreaName     string        `json:"area_name"`
+	Modules      []ModuleScore `json:"modules"`
+	WeightedSum  float64       `json:"weighted_sum"`
+	TotalWeight  float64       `json:"total_weight"`
+	AreaScore    float64       `json:"area_score"` // WeightedSum / TotalWeight
+}
+
+// Level 3: Regulation Area Score
+type RegulationAreaScore struct {
+	RegulationID   string  `json:"regulation_id"`   // dsgvo, nis2, iso27001, ai_act
+	RegulationName string  `json:"regulation_name"` // Display name
+	Score          float64 `json:"score"`            // 0-100
+	Weight         float64 `json:"weight"`           // regulation weight in GCI
+	WeightedScore  float64 `json:"weighted_score"`   // Score * Weight
+	ModuleCount    int     `json:"module_count"`
+	CompletedCount int     `json:"completed_count"`
+}
+
+// Level 4: GCI Result
+type GCIResult struct {
+	TenantID          string                `json:"tenant_id"`
+	GCIScore          float64               `json:"gci_score"`           // 0-100
+	MaturityLevel     string                `json:"maturity_level"`      // Optimized, Managed, Defined, Reactive, HighRisk
+	MaturityLabel     string                `json:"maturity_label"`      // German label
+	CalculatedAt      time.Time             `json:"calculated_at"`
+	Profile           string                `json:"profile"`             // default, nis2_relevant, ki_nutzer
+	AreaScores        []RegulationAreaScore `json:"area_scores"`
+	CriticalityMult   float64              `json:"criticality_multiplier"`
+	IncidentAdj       float64              `json:"incident_adjustment"`
+	AuditTrail        []AuditEntry          `json:"audit_trail"`
+}
+
+// GCI Breakdown with all 4 levels
+type GCIBreakdown struct {
+	GCIResult
+	Level1Modules  []ModuleScore       `json:"level1_modules"`
+	Level2Areas    []RiskWeightedScore `json:"level2_areas"`
+}
+
+// MaturityLevel constants
+const (
+	MaturityOptimized = "OPTIMIZED"
+	MaturityManaged   = "MANAGED"
+	MaturityDefined   = "DEFINED"
+	MaturityReactive  = "REACTIVE"
+	MaturityHighRisk  = "HIGH_RISK"
+)
+
+// Maturity level labels (German)
+var MaturityLabels = map[string]string{
+	MaturityOptimized: "Optimiert",
+	MaturityManaged:   "Gesteuert",
+	MaturityDefined:   "Definiert",
+	MaturityReactive:  "Reaktiv",
+	MaturityHighRisk:  "Hohes Risiko",
+}
+
+// AuditEntry for score transparency
+type AuditEntry struct {
+	Timestamp   time.Time `json:"timestamp"`
+	Factor      string    `json:"factor"`
+	Description string    `json:"description"`
+	Value       float64   `json:"value"`
+	Impact      string    `json:"impact"` // positive, negative, neutral
+}
+
+// ComplianceMatrixEntry maps roles to regulations
+type ComplianceMatrixEntry struct {
+	Role           string             `json:"role"`
+	RoleName       string             `json:"role_name"`
+	Regulations    map[string]float64 `json:"regulations"` // regulation_id -> score
+	OverallScore   float64            `json:"overall_score"`
+	RequiredModules int               `json:"required_modules"`
+	CompletedModules int              `json:"completed_modules"`
+}
+
+// GCI History snapshot
+type GCISnapshot struct {
+	TenantID      string    `json:"tenant_id"`
+	Score         float64   `json:"score"`
+	MaturityLevel string    `json:"maturity_level"`
+	AreaScores    map[string]float64 `json:"area_scores"`
+	CalculatedAt  time.Time `json:"calculated_at"`
+}