fix(quality): Ruff/CVE/TS-Fixes, 104 neue Tests, Complexity-Refactoring

- Ruff: 144 auto-fixes (unused imports, == None → is None), F821/F811/F841 manuell
- CVEs: python-multipart>=0.0.22, weasyprint>=68.0, pillow>=12.1.1, npm audit fix (0 vulns)
- TS: 5 tote Drafting-Engine-Dateien entfernt, allowed-facts/sanitizer/StepHeader/context fixes
- Tests: +104 (ISMS 58, Evidence 18, VVT 14, Generation 14) → 1449 passed
- Refactoring: collect_ci_evidence (F→A), row_to_response (E→A), extract_requirements (E→A)
- Dead Code: pca-platform, 7 Go-Handler, dsr_api.py, duplicate Schemas entfernt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

admin-compliance/components/sdk/__tests__/StepHeader.test.tsx

@@ -1,12 +1,14 @@
 import { describe, it, expect } from 'vitest'
 import { STEP_EXPLANATIONS } from '../StepHeader'
 
+type StepExplanationKey = keyof typeof STEP_EXPLANATIONS
+
 // Focus on testing the STEP_EXPLANATIONS data structure
 // Component tests require more complex SDK context mocking
 
 describe('STEP_EXPLANATIONS', () => {
   it('should have explanations for all Phase 1 steps', () => {
-    const phase1Steps = [
+    const phase1Steps: StepExplanationKey[] = [
       'use-case-workshop',
       'screening',
       'modules',
@@ -29,7 +31,7 @@ describe('STEP_EXPLANATIONS', () => {
   })
 
   it('should have explanations for all Phase 2 steps', () => {
-    const phase2Steps = [
+    const phase2Steps: StepExplanationKey[] = [
       'ai-act',
       'obligations',
       'dsfa',
@@ -93,8 +95,8 @@ describe('STEP_EXPLANATIONS', () => {
     expect(dsfa.explanation.length).toBeGreaterThan(50)
   })
 
-  it('should cover all 19 SDK steps', () => {
-    const allStepIds = [
+  it('should cover all core SDK steps', () => {
+    const coreStepIds: StepExplanationKey[] = [
       // Phase 1
       'use-case-workshop',
       'screening',
@@ -118,10 +120,11 @@ describe('STEP_EXPLANATIONS', () => {
       'escalations',
     ]
 
-    expect(Object.keys(STEP_EXPLANATIONS).length).toBe(allStepIds.length)
-
-    allStepIds.forEach(stepId => {
+    coreStepIds.forEach(stepId => {
       expect(STEP_EXPLANATIONS[stepId]).toBeDefined()
     })
+
+    // Ensure we have at least the core steps plus additional module explanations
+    expect(Object.keys(STEP_EXPLANATIONS).length).toBeGreaterThanOrEqual(coreStepIds.length)
   })
 })