fix(quality): Ruff/CVE/TS-Fixes, 104 neue Tests, Complexity-Refactoring

- Ruff: 144 auto-fixes (unused imports, == None → is None), F821/F811/F841 manuell
- CVEs: python-multipart>=0.0.22, weasyprint>=68.0, pillow>=12.1.1, npm audit fix (0 vulns)
- TS: 5 tote Drafting-Engine-Dateien entfernt, allowed-facts/sanitizer/StepHeader/context fixes
- Tests: +104 (ISMS 58, Evidence 18, VVT 14, Generation 14) → 1449 passed
- Refactoring: collect_ci_evidence (F→A), row_to_response (E→A), extract_requirements (E→A)
- Dead Code: pca-platform, 7 Go-Handler, dsr_api.py, duplicate Schemas entfernt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/compliance/api/dsfa_routes.py

@@ -33,7 +33,6 @@ from classroom_engine.database import get_db
 logger = logging.getLogger(__name__)
 router = APIRouter(prefix="/dsfa", tags=["compliance-dsfa"])
 
-from .tenant_utils import get_tenant_id as _shared_get_tenant_id
 
 # Legacy compat — still used by _get_tenant_id() below; will be removed once
 # all call-sites switch to Depends(get_tenant_id).
@@ -855,7 +854,7 @@ async def approve_dsfa(
 
     if request.approved:
         new_status = "approved"
-        row = db.execute(
+        db.execute(
             text("""
                 UPDATE compliance_dsfas
                 SET status = 'approved', approved_by = :approved_by, approved_at = NOW(), updated_at = NOW()
@@ -866,7 +865,7 @@ async def approve_dsfa(
         ).fetchone()
     else:
         new_status = "needs-update"
-        row = db.execute(
+        db.execute(
             text("""
                 UPDATE compliance_dsfas
                 SET status = 'needs-update', updated_at = NOW()