fix(quality): Ruff/CVE/TS-Fixes, 104 neue Tests, Complexity-Refactoring

- Ruff: 144 auto-fixes (unused imports, == None → is None), F821/F811/F841 manuell
- CVEs: python-multipart>=0.0.22, weasyprint>=68.0, pillow>=12.1.1, npm audit fix (0 vulns)
- TS: 5 tote Drafting-Engine-Dateien entfernt, allowed-facts/sanitizer/StepHeader/context fixes
- Tests: +104 (ISMS 58, Evidence 18, VVT 14, Generation 14) → 1449 passed
- Refactoring: collect_ci_evidence (F→A), row_to_response (E→A), extract_requirements (E→A)
- Dead Code: pca-platform, 7 Go-Handler, dsr_api.py, duplicate Schemas entfernt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/compliance/api/screening_routes.py

@@ -257,18 +257,6 @@ def map_osv_severity(vuln: dict) -> tuple[str, float]:
     severity = "MEDIUM"
     cvss = 5.0
 
-    # Check severity array
-    for sev in vuln.get("severity", []):
-        if sev.get("type") == "CVSS_V3":
-            score_str = sev.get("score", "")
-            # Extract base score from CVSS vector
-            try:
-                import re as _re
-                # CVSS vectors don't contain the score directly, try database_specific
-                pass
-            except Exception:
-                pass
-
     # Check database_specific for severity
     db_specific = vuln.get("database_specific", {})
     if "severity" in db_specific: