feat(cookie): A — Findings auditfest an Controls verdrahten

Jeder Cookie-Befund traegt jetzt ein strukturiertes control-Feld
(control_id aus doc_check_controls + regulation + article) statt nur
hardcodeter Strings: vague_duration->AUTH-2051-A03 (Art.5(1)e+13),
tracker_as_necessary->DATA-2851-A05 (§25 TDDDG), third_country->
DATA-1624-A04 (Art.44). Kette Regulation->Article->Control->Finding.
Frontend zeigt die Rechtsgrundlage je Befund. (Controls tragen
regulation/article noch NULL -> hier mitgeliefert bis gepflegt.)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

admin-compliance/app/sdk/agent/_components/CookieLibraryPanel.tsx

@@ -16,6 +16,7 @@ export interface CookieFinding {
   declared: string
   library_purpose: string
   remediation: string
+  control?: { control_id?: string | null; regulation?: string; article?: string }
 }
 
 interface CheckData {
@@ -71,6 +72,12 @@ export function CookieFindingList({ data }: { data: CheckData }) {
                 <div className="text-xs text-gray-500">Library-Zweck: {f.library_purpose}</div>
               )}
               <div className="text-xs text-gray-700">{f.remediation}</div>
+              {f.control?.regulation && f.control.regulation !== '—' && (
+                <div className="text-[10px] text-gray-400">
+                  Rechtsgrundlage: {f.control.regulation} {f.control.article}
+                  {f.control.control_id && ` · Control ${f.control.control_id}`}
+                </div>
+              )}
             </div>
           ))}
         </div>