feat(cra): Maßnahmen-Provenienz + Lizenzklasse je Normquelle

Jede Normreferenz einer Maßnahme wird lizenzklassifiziert (eu_law /
public_domain / open / paid_reference) — paid-reference-Normen werden nur als
Verweis geführt, nie im Text gespeichert (idea/expression). Kuratierte
Maßnahmen tragen Tier 'core', KI-/Fallback-Maßnahmen 'review' (indikativ).
Frontend zeigt Quellen-Badges + "indikativ"-Kennzeichnung. Methodik in
docs-src/development/mapping-methodology.md (Szenario C, Due-Diligence).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend-compliance/compliance/api/cra_annex_i_data.py

@@ -268,6 +268,8 @@ SEVERITY_WEIGHT = {
 import json as _json
 import os as _os
 
+from compliance.data.norm_sources import classify_refs as _classify_refs
+
 MEASURE_DETAILS: dict = {}
 
 try:
@@ -275,6 +277,12 @@ try:
     with open(_MEAS_PATH, encoding="utf-8") as _fh:
         _curated = _json.load(_fh)
     MEASURE_DETAILS = {m["id"]: m for m in _curated if m.get("id")}
+    # Provenance: curated measures are expert/standards-based ('core' tier); each
+    # norm_ref is license-classified (law/public/open vs paid-reference-only).
+    for _m in MEASURE_DETAILS.values():
+        _m.setdefault("tier", "core")
+        _m.setdefault("provenance", "curated_expert_standards")
+        _m["norm_sources"] = _classify_refs(_m.get("norm_refs", []))
     for _m in _curated:
         if _m.get("id") and _m.get("name"):
             MEASURES[_m["id"]] = _m["name"]