fix(quality): Ruff/CVE/TS-Fixes, 104 neue Tests, Complexity-Refactoring

- Ruff: 144 auto-fixes (unused imports, == None → is None), F821/F811/F841 manuell
- CVEs: python-multipart>=0.0.22, weasyprint>=68.0, pillow>=12.1.1, npm audit fix (0 vulns)
- TS: 5 tote Drafting-Engine-Dateien entfernt, allowed-facts/sanitizer/StepHeader/context fixes
- Tests: +104 (ISMS 58, Evidence 18, VVT 14, Generation 14) → 1449 passed
- Refactoring: collect_ci_evidence (F→A), row_to_response (E→A), extract_requirements (E→A)
- Dead Code: pca-platform, 7 Go-Handler, dsr_api.py, duplicate Schemas entfernt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/compliance/api/banner_routes.py

@@ -12,7 +12,6 @@ from typing import Optional, List
 from fastapi import APIRouter, Depends, HTTPException, Query, Header
 from pydantic import BaseModel
 from sqlalchemy.orm import Session
-from sqlalchemy import func
 
 from classroom_engine.database import get_db
 from ..db.banner_models import (
@@ -317,12 +316,12 @@ async def get_site_config(
 
     categories = db.query(BannerCategoryConfigDB).filter(
         BannerCategoryConfigDB.site_config_id == config.id,
-        BannerCategoryConfigDB.is_active == True,
+        BannerCategoryConfigDB.is_active,
     ).order_by(BannerCategoryConfigDB.sort_order).all()
 
     vendors = db.query(BannerVendorConfigDB).filter(
         BannerVendorConfigDB.site_config_id == config.id,
-        BannerVendorConfigDB.is_active == True,
+        BannerVendorConfigDB.is_active,
     ).all()
 
     result = _site_config_to_dict(config)