fix(quality): Ruff/CVE/TS-Fixes, 104 neue Tests, Complexity-Refactoring

- Ruff: 144 auto-fixes (unused imports, == None → is None), F821/F811/F841 manuell
- CVEs: python-multipart>=0.0.22, weasyprint>=68.0, pillow>=12.1.1, npm audit fix (0 vulns)
- TS: 5 tote Drafting-Engine-Dateien entfernt, allowed-facts/sanitizer/StepHeader/context fixes
- Tests: +104 (ISMS 58, Evidence 18, VVT 14, Generation 14) → 1449 passed
- Refactoring: collect_ci_evidence (F→A), row_to_response (E→A), extract_requirements (E→A)
- Dead Code: pca-platform, 7 Go-Handler, dsr_api.py, duplicate Schemas entfernt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

admin-compliance/lib/sdk/drafting-engine/allowed-facts.ts

@@ -95,11 +95,11 @@ export function buildAllowedFacts(
   const scope = state.complianceScope
 
   return {
-    companyName: profile?.name ?? 'Unbekannt',
+    companyName: profile?.companyName ?? 'Unbekannt',
     legalForm: profile?.legalForm ?? '',
     industry: profile?.industry ?? '',
-    location: profile?.location ?? '',
-    employeeCount: profile?.employeeCount ?? 0,
+    location: profile?.headquartersCity ?? '',
+    employeeCount: parseEmployeeCount(profile?.employeeCount),
 
     teamStructure: deriveTeamStructure(profile),
     itLandscape: deriveItLandscape(profile),
@@ -213,11 +213,33 @@ export function checkForDisallowedContent(
 // Private Helpers
 // ============================================================================
 
+/**
+ * Parst den employeeCount-String (z.B. "1-9", "50-249", "1000+") in eine Zahl.
+ * Verwendet den Mittelwert des Bereichs oder den unteren Wert bei "+".
+ */
+function parseEmployeeCount(value: string | undefined | null): number {
+  if (!value) return 0
+  // Handle "1000+" style
+  const plusMatch = value.match(/^(\d+)\+$/)
+  if (plusMatch) return parseInt(plusMatch[1], 10)
+  // Handle "50-249" style ranges
+  const rangeMatch = value.match(/^(\d+)-(\d+)$/)
+  if (rangeMatch) {
+    const low = parseInt(rangeMatch[1], 10)
+    const high = parseInt(rangeMatch[2], 10)
+    return Math.round((low + high) / 2)
+  }
+  // Try plain number
+  const num = parseInt(value, 10)
+  return isNaN(num) ? 0 : num
+}
+
 function deriveTeamStructure(profile: CompanyProfile | null): string {
   if (!profile) return ''
   // Ableitung aus verfuegbaren Profildaten
-  if (profile.employeeCount > 500) return 'Konzernstruktur'
-  if (profile.employeeCount > 50) return 'mittelstaendisch'
+  const count = parseEmployeeCount(profile.employeeCount)
+  if (count > 500) return 'Konzernstruktur'
+  if (count > 50) return 'mittelstaendisch'
   return 'Kleinunternehmen'
 }
 
@@ -225,15 +247,15 @@ function deriveItLandscape(profile: CompanyProfile | null): string {
   if (!profile) return ''
   return profile.businessModel?.includes('SaaS') ? 'Cloud-First' :
          profile.businessModel?.includes('Cloud') ? 'Cloud-First' :
-         profile.isPublicSector ? 'On-Premise' : 'Hybrid'
+         'Hybrid'
 }
 
 function deriveSpecialFeatures(profile: CompanyProfile | null): string[] {
   if (!profile) return []
   const features: string[] = []
-  if (profile.isPublicSector) features.push('Oeffentlicher Sektor')
-  if (profile.employeeCount > 250) features.push('Grossunternehmen')
-  if (profile.dataProtectionOfficer) features.push('Interner DSB benannt')
+  const count = parseEmployeeCount(profile.employeeCount)
+  if (count > 250) features.push('Grossunternehmen')
+  if (profile.dpoName) features.push('Interner DSB benannt')
   return features
 }
 
@@ -253,5 +275,5 @@ function deriveTriggeredRegulations(
 
 function derivePrimaryUseCases(state: SDKState): string[] {
   if (!state.useCases || state.useCases.length === 0) return []
-  return state.useCases.slice(0, 3).map(uc => uc.name || uc.title || 'Unbenannt')
+  return state.useCases.slice(0, 3).map(uc => uc.name || 'Unbenannt')
 }