feat(cra): Flow-2 UI — Scanner-Repo wählen → echtes Assessment

- GET /v1/cra/scanner-repos: distinct repo_ids (+counts) vom Scanner-MCP für den Picker.
- useCRA: scannerRepo-State; bei Auswahl POST /assess-from-scanner (echte Findings),
  sonst by-iace/Demo wie bisher.
- ScannerRepoPicker im CRA/Cyber-Tab; leere Auswahl = Demo, Repo gewählt = echte Befunde.

Mapping repo_id↔Projekt aktuell UI-seitig (ephemeral); DB-Persistenz pro Projekt folgt.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

admin-compliance/app/sdk/iace/[projectId]/cra/page.tsx

@@ -5,11 +5,12 @@ import { useCRA } from './_hooks/useCRA'
 import { CRACyberView } from './_components/CRACyberView'
 import { WeightsControl } from './_components/WeightsControl'
 import { SnapshotPanel } from './_components/SnapshotPanel'
+import { ScannerRepoPicker } from './_components/ScannerRepoPicker'
 
 export default function CRAPage() {
   const params = useParams()
   const projectId = params?.projectId as string | undefined
-  const { data, live, weights, setWeights, snapshots, saveSnapshot, viewSnapshot } = useCRA(projectId)
+  const { data, live, weights, setWeights, snapshots, saveSnapshot, viewSnapshot, scannerRepo, setScannerRepo } = useCRA(projectId)
   if (!data) {
     return <p className="text-sm text-gray-500">CRA-Risikobeurteilung wird geladen …</p>
   }
@@ -28,6 +29,7 @@ export default function CRAPage() {
           Backend nicht erreichbar — statisches Szenario angezeigt.
         </p>
       )}
+      <ScannerRepoPicker value={scannerRepo} onChange={setScannerRepo} />
       <WeightsControl weights={weights} onChange={setWeights} />
       <CRACyberView data={data} />
       <SnapshotPanel snapshots={snapshots} onSave={saveSnapshot} onView={viewSnapshot} />