fix(quality): Ruff/CVE/TS-Fixes, 104 neue Tests, Complexity-Refactoring

- Ruff: 144 auto-fixes (unused imports, == None → is None), F821/F811/F841 manuell
- CVEs: python-multipart>=0.0.22, weasyprint>=68.0, pillow>=12.1.1, npm audit fix (0 vulns)
- TS: 5 tote Drafting-Engine-Dateien entfernt, allowed-facts/sanitizer/StepHeader/context fixes
- Tests: +104 (ISMS 58, Evidence 18, VVT 14, Generation 14) → 1449 passed
- Refactoring: collect_ci_evidence (F→A), row_to_response (E→A), extract_requirements (E→A)
- Dead Code: pca-platform, 7 Go-Handler, dsr_api.py, duplicate Schemas entfernt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/tests/test_company_profile_routes.py

@@ -50,7 +50,7 @@ class TestRowToResponse:
     """Tests for DB row to response conversion."""
 
     def _make_row(self, **overrides):
-        """Create a mock DB row with 30 fields."""
+        """Create a mock DB row with 40 fields (matching row_to_response indices)."""
         defaults = [
             "uuid-123",      # 0: id
             "default",       # 1: tenant_id
@@ -82,6 +82,17 @@ class TestRowToResponse:
             "2026-01-01",    # 27: completed_at
             "2026-01-01",    # 28: created_at
             "2026-01-01",    # 29: updated_at
+            # Phase 2 fields (indices 30-39)
+            [],              # 30: repos
+            [],              # 31: document_sources
+            [],              # 32: processing_systems
+            [],              # 33: ai_systems
+            [],              # 34: technical_contacts
+            False,           # 35: subject_to_nis2
+            False,           # 36: subject_to_ai_act
+            False,           # 37: subject_to_iso27001
+            None,            # 38: supervisory_authority
+            12,              # 39: review_cycle_months
         ]
         return tuple(defaults)