fix(quality): Ruff/CVE/TS-Fixes, 104 neue Tests, Complexity-Refactoring

- Ruff: 144 auto-fixes (unused imports, == None → is None), F821/F811/F841 manuell
- CVEs: python-multipart>=0.0.22, weasyprint>=68.0, pillow>=12.1.1, npm audit fix (0 vulns)
- TS: 5 tote Drafting-Engine-Dateien entfernt, allowed-facts/sanitizer/StepHeader/context fixes
- Tests: +104 (ISMS 58, Evidence 18, VVT 14, Generation 14) → 1449 passed
- Refactoring: collect_ci_evidence (F→A), row_to_response (E→A), extract_requirements (E→A)
- Dead Code: pca-platform, 7 Go-Handler, dsr_api.py, duplicate Schemas entfernt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/compliance/services/report_generator.py

@@ -19,16 +19,11 @@ from sqlalchemy.orm import Session
 from sqlalchemy import func
 
 from ..db.models import (
-    RegulationDB,
     RequirementDB,
     ControlDB,
     ControlMappingDB,
-    EvidenceDB,
-    RiskDB,
-    AuditExportDB,
     ControlStatusEnum,
     RiskLevelEnum,
-    EvidenceStatusEnum,
 )
 from ..db.repository import (
     RegulationRepository,
@@ -171,7 +166,6 @@ class ComplianceReportGenerator:
 
         # Control status findings
         by_status = ctrl_stats.get("by_status", {})
-        passed = by_status.get("pass", 0)
         failed = by_status.get("fail", 0)
         planned = by_status.get("planned", 0)
 
@@ -200,10 +194,8 @@ class ComplianceReportGenerator:
         """Generate compliance score section with breakdown."""
         stats = self.ctrl_repo.get_statistics()
 
-        by_domain = stats.get("by_domain", {})
-        domain_scores = {}
-
         controls = self.ctrl_repo.get_all()
+        domain_scores = {}
         domain_stats = {}
 
         for ctrl in controls: