fix(quality): Ruff/CVE/TS-Fixes, 104 neue Tests, Complexity-Refactoring

- Ruff: 144 auto-fixes (unused imports, == None → is None), F821/F811/F841 manuell
- CVEs: python-multipart>=0.0.22, weasyprint>=68.0, pillow>=12.1.1, npm audit fix (0 vulns)
- TS: 5 tote Drafting-Engine-Dateien entfernt, allowed-facts/sanitizer/StepHeader/context fixes
- Tests: +104 (ISMS 58, Evidence 18, VVT 14, Generation 14) → 1449 passed
- Refactoring: collect_ci_evidence (F→A), row_to_response (E→A), extract_requirements (E→A)
- Dead Code: pca-platform, 7 Go-Handler, dsr_api.py, duplicate Schemas entfernt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/compliance/api/legal_document_routes.py

@@ -671,7 +671,7 @@ async def get_my_consents(
         .filter(
             UserConsentDB.tenant_id == tid,
             UserConsentDB.user_id == user_id,
-            UserConsentDB.withdrawn_at == None,
+            UserConsentDB.withdrawn_at is None,
         )
         .order_by(UserConsentDB.consented_at.desc())
         .all()
@@ -694,8 +694,8 @@ async def check_consent(
             UserConsentDB.tenant_id == tid,
             UserConsentDB.user_id == user_id,
             UserConsentDB.document_type == document_type,
-            UserConsentDB.consented == True,
-            UserConsentDB.withdrawn_at == None,
+            UserConsentDB.consented,
+            UserConsentDB.withdrawn_at is None,
         )
         .order_by(UserConsentDB.consented_at.desc())
         .first()
@@ -757,10 +757,10 @@ async def get_consent_stats(
 
     total = base.count()
     active = base.filter(
-        UserConsentDB.consented == True,
-        UserConsentDB.withdrawn_at == None,
+        UserConsentDB.consented,
+        UserConsentDB.withdrawn_at is None,
     ).count()
-    withdrawn = base.filter(UserConsentDB.withdrawn_at != None).count()
+    withdrawn = base.filter(UserConsentDB.withdrawn_at is not None).count()
 
     # By document type
     by_type = {}