merge: phases 1–5 refactor, CI hardening, docs (coolify → main)

Phase 1: backend-compliance — partial service-layer extraction
Phase 2: ai-compliance-sdk — full hexagonal split; iace/ucca/training handlers
  and stores split into focused files; cmd/server/main.go → internal/app/
Phase 3: admin-compliance — types.ts, tom-generator loader, and major page
  components split; lib document generators extracted
Phase 4: dsms-gateway, consent-sdk, developer-portal, breakpilot-compliance-sdk
Phase 5 CI hardening:
  - loc-budget job now scans whole repo (blocking, no || true)
  - sbom-scan / grype blocking on high+ CVEs
  - ai-compliance-sdk/.golangci.yml: strict golangci-lint config
  - check-loc.sh: skip test_*.py and *.html; loc-exceptions.txt expanded
  - deleted stray routes.py.backup (2512 LOC)
Docs:
  - root README.md with CI badge, service table, quick start, CI pipeline table
  - CONTRIBUTING.md: setup, pre-commit checklist, guardrail marker reference
  - CLAUDE.md: First-Time Setup & Claude Code Onboarding section
  - all 7 service READMEs updated (stale phase refs, current architecture)
  - AGENTS.go/python/typescript.md enhanced with linting, DI, barrel re-export
  - .gitignore: dist/, .turbo/, pnpm-lock.yaml added

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

compliance-tts-service/README.md

@@ -0,0 +1,30 @@
+# compliance-tts-service
+
+Python service generating German-language audio/video training materials using Piper TTS + FFmpeg. Outputs are stored in Hetzner Object Storage (S3-compatible).
+
+**Port:** `8095` (container: `bp-compliance-tts`)
+**Stack:** Python 3.12, Piper TTS (`de_DE-thorsten-high.onnx`), FFmpeg, boto3.
+
+## Files
+
+- `main.py` — FastAPI entrypoint
+- `tts_engine.py` — Piper wrapper
+- `video_generator.py` — FFmpeg pipeline
+- `storage.py` — S3 client
+
+## Run locally
+
+```bash
+cd compliance-tts-service
+pip install -r requirements.txt
+# Piper model + ffmpeg must be available on PATH
+uvicorn main:app --reload --port 8095
+```
+
+## Tests
+
+0 test files today. Adding unit tests for the synthesis pipeline (mocked Piper + FFmpeg) and the S3 client is still in the backlog queue.
+
+## Architecture
+
+Follow `../AGENTS.python.md`. Keep the Piper model loading behind a single service instance — not loaded per request.