fix(quality): Ruff/CVE/TS-Fixes, 104 neue Tests, Complexity-Refactoring

- Ruff: 144 auto-fixes (unused imports, == None → is None), F821/F811/F841 manuell
- CVEs: python-multipart>=0.0.22, weasyprint>=68.0, pillow>=12.1.1, npm audit fix (0 vulns)
- TS: 5 tote Drafting-Engine-Dateien entfernt, allowed-facts/sanitizer/StepHeader/context fixes
- Tests: +104 (ISMS 58, Evidence 18, VVT 14, Generation 14) → 1449 passed
- Refactoring: collect_ci_evidence (F→A), row_to_response (E→A), extract_requirements (E→A)
- Dead Code: pca-platform, 7 Go-Handler, dsr_api.py, duplicate Schemas entfernt

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/tests/test_evidence_routes.py

@@ -252,3 +252,268 @@ class TestEvidenceCIStatus:
             MockRepo.return_value.get_all.return_value = []
             response = client.get("/evidence/ci-status", params={"control_id": CONTROL_UUID})
         assert response.status_code == 200
+
+    def test_ci_status_without_control_id(self):
+        """GET /evidence/ci-status without control_id returns all CI evidence."""
+        mock_query = MagicMock()
+        mock_query.filter.return_value = mock_query
+        mock_query.order_by.return_value = mock_query
+        mock_query.limit.return_value = mock_query
+        mock_query.all.return_value = []
+        mock_db.query.return_value = mock_query
+        response = client.get("/evidence/ci-status")
+        assert response.status_code == 200
+        data = response.json()
+        assert data["period_days"] == 30
+        assert data["total_evidence"] == 0
+        assert data["controls"] == []
+
+    def test_ci_status_custom_days_param(self):
+        """GET /evidence/ci-status with custom days lookback."""
+        mock_query = MagicMock()
+        mock_query.filter.return_value = mock_query
+        mock_query.order_by.return_value = mock_query
+        mock_query.limit.return_value = mock_query
+        mock_query.all.return_value = []
+        mock_db.query.return_value = mock_query
+        response = client.get("/evidence/ci-status", params={"days": 7})
+        assert response.status_code == 200
+        data = response.json()
+        assert data["period_days"] == 7
+
+
+class TestCollectCIEvidence:
+    """Tests for POST /evidence/collect."""
+
+    def test_collect_sast_evidence_success(self):
+        """Collect SAST evidence with Semgrep-format report data."""
+        ctrl = make_control({"control_id": "SDLC-001"})
+        evidence = make_evidence({
+            "evidence_type": "ci_sast",
+            "source": "ci_pipeline",
+            "ci_job_id": "job-456",
+        })
+        with patch("compliance.api.evidence_routes.ControlRepository") as MockCtrlRepo, \
+             patch("compliance.api.evidence_routes._store_evidence", return_value=evidence), \
+             patch("compliance.api.evidence_routes._update_risks", return_value=None):
+            MockCtrlRepo.return_value.get_by_control_id.return_value = ctrl
+            response = client.post(
+                "/evidence/collect",
+                params={"source": "sast", "ci_job_id": "job-456"},
+                json={"results": [
+                    {"check_id": "python.lang.security", "extra": {"severity": "MEDIUM"}},
+                ]},
+            )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["success"] is True
+        assert data["source"] == "sast"
+        assert data["control_id"] == "SDLC-001"
+
+    def test_collect_unknown_source_returns_400(self):
+        """Unknown source should return 400."""
+        response = client.post(
+            "/evidence/collect",
+            params={"source": "unknown_tool"},
+            json={},
+        )
+        assert response.status_code == 400
+        assert "Unknown source" in response.json()["detail"]
+
+    def test_collect_control_not_found_returns_404(self):
+        """If the mapped control does not exist in DB, return 404."""
+        with patch("compliance.api.evidence_routes.ControlRepository") as MockCtrlRepo:
+            MockCtrlRepo.return_value.get_by_control_id.return_value = None
+            response = client.post(
+                "/evidence/collect",
+                params={"source": "sast"},
+                json={"results": []},
+            )
+        assert response.status_code == 404
+        assert "SDLC-001" in response.json()["detail"]
+
+    def test_collect_with_null_report_data(self):
+        """Collect with no report data body (None)."""
+        ctrl = make_control({"control_id": "SDLC-002"})
+        evidence = make_evidence({
+            "evidence_type": "ci_dependency_scan",
+            "source": "ci_pipeline",
+        })
+        with patch("compliance.api.evidence_routes.ControlRepository") as MockCtrlRepo, \
+             patch("compliance.api.evidence_routes._store_evidence", return_value=evidence), \
+             patch("compliance.api.evidence_routes._update_risks", return_value=None):
+            MockCtrlRepo.return_value.get_by_control_id.return_value = ctrl
+            response = client.post(
+                "/evidence/collect",
+                params={"source": "dependency_scan"},
+            )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["success"] is True
+
+    def test_collect_sbom_source(self):
+        """Collect SBOM evidence with components list."""
+        ctrl = make_control({"control_id": "SDLC-005"})
+        evidence = make_evidence({
+            "evidence_type": "ci_sbom",
+            "source": "ci_pipeline",
+        })
+        with patch("compliance.api.evidence_routes.ControlRepository") as MockCtrlRepo, \
+             patch("compliance.api.evidence_routes._store_evidence", return_value=evidence), \
+             patch("compliance.api.evidence_routes._update_risks", return_value=None):
+            MockCtrlRepo.return_value.get_by_control_id.return_value = ctrl
+            response = client.post(
+                "/evidence/collect",
+                params={"source": "sbom"},
+                json={"components": [
+                    {"name": "fastapi", "version": "0.100.0"},
+                    {"name": "pydantic", "version": "2.0.0"},
+                ]},
+            )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["success"] is True
+        assert data["source"] == "sbom"
+
+
+class TestParseCIEvidence:
+    """Unit tests for _parse_ci_evidence helper."""
+
+    def test_parse_empty_data(self):
+        from compliance.api.evidence_routes import _parse_ci_evidence
+        result = _parse_ci_evidence({})
+        assert result["findings_count"] == 0
+        assert result["critical_findings"] == 0
+        assert result["evidence_status"] == "valid"
+
+    def test_parse_none_data(self):
+        from compliance.api.evidence_routes import _parse_ci_evidence
+        result = _parse_ci_evidence(None)
+        assert result["evidence_status"] == "valid"
+        assert result["report_json"] == "{}"
+
+    def test_parse_semgrep_with_critical(self):
+        """Semgrep results with CRITICAL severity → status=failed."""
+        from compliance.api.evidence_routes import _parse_ci_evidence
+        data = {
+            "results": [
+                {"check_id": "sql-injection", "extra": {"severity": "CRITICAL"}},
+                {"check_id": "xss", "extra": {"severity": "MEDIUM"}},
+            ]
+        }
+        result = _parse_ci_evidence(data)
+        assert result["findings_count"] == 2
+        assert result["critical_findings"] == 1
+        assert result["evidence_status"] == "failed"
+
+    def test_parse_trivy_format(self):
+        """Trivy Results format with Vulnerabilities."""
+        from compliance.api.evidence_routes import _parse_ci_evidence
+        data = {
+            "Results": [
+                {
+                    "Target": "python:3.11",
+                    "Vulnerabilities": [
+                        {"VulnerabilityID": "CVE-2024-001", "Severity": "HIGH"},
+                        {"VulnerabilityID": "CVE-2024-002", "Severity": "LOW"},
+                    ],
+                }
+            ]
+        }
+        result = _parse_ci_evidence(data)
+        assert result["findings_count"] == 2
+        assert result["critical_findings"] == 1
+        assert result["evidence_status"] == "failed"
+
+    def test_parse_generic_findings(self):
+        """Generic findings array format."""
+        from compliance.api.evidence_routes import _parse_ci_evidence
+        data = {"findings": [{"id": "f1"}, {"id": "f2"}, {"id": "f3"}]}
+        result = _parse_ci_evidence(data)
+        assert result["findings_count"] == 3
+        assert result["critical_findings"] == 0
+        assert result["evidence_status"] == "valid"
+
+    def test_parse_sbom_components(self):
+        """SBOM components → findings_count = number of components."""
+        from compliance.api.evidence_routes import _parse_ci_evidence
+        data = {"components": [{"name": "a"}, {"name": "b"}]}
+        result = _parse_ci_evidence(data)
+        assert result["findings_count"] == 2
+        assert result["evidence_status"] == "valid"
+
+
+class TestExtractFindingsDetail:
+    """Unit tests for _extract_findings_detail helper."""
+
+    def test_extract_empty(self):
+        from compliance.api.evidence_routes import _extract_findings_detail
+        result = _extract_findings_detail({})
+        assert result == {"critical": 0, "high": 0, "medium": 0, "low": 0}
+
+    def test_extract_none(self):
+        from compliance.api.evidence_routes import _extract_findings_detail
+        result = _extract_findings_detail(None)
+        assert result == {"critical": 0, "high": 0, "medium": 0, "low": 0}
+
+    def test_extract_semgrep_severities(self):
+        from compliance.api.evidence_routes import _extract_findings_detail
+        data = {
+            "results": [
+                {"extra": {"severity": "CRITICAL"}},
+                {"extra": {"severity": "HIGH"}},
+                {"extra": {"severity": "MEDIUM"}},
+                {"extra": {"severity": "LOW"}},
+                {"extra": {"severity": "INFO"}},
+            ]
+        }
+        result = _extract_findings_detail(data)
+        assert result["critical"] == 1
+        assert result["high"] == 1
+        assert result["medium"] == 1
+        assert result["low"] == 2  # LOW + INFO both count as low
+
+
+class TestListEvidenceEdgeCases:
+    """Additional edge-case tests for GET /evidence."""
+
+    def test_list_filter_by_status(self):
+        """Filter by status parameter."""
+        ev_valid = make_evidence({"status": MagicMock(value="valid")})
+        ev_failed = make_evidence({"status": MagicMock(value="failed")})
+        with patch("compliance.api.evidence_routes.EvidenceRepository") as MockRepo:
+            MockRepo.return_value.get_all.return_value = [ev_valid, ev_failed]
+            response = client.get("/evidence", params={"status": "valid"})
+        assert response.status_code == 200
+        # The route filters in-memory by status enum
+        data = response.json()
+        # At least it returns without error (status enum matching may differ with mocks)
+        assert "evidence" in data
+
+    def test_list_filter_invalid_status(self):
+        """Invalid status value should be ignored (no crash)."""
+        with patch("compliance.api.evidence_routes.EvidenceRepository") as MockRepo:
+            MockRepo.return_value.get_all.return_value = [make_evidence()]
+            response = client.get("/evidence", params={"status": "nonexistent_status"})
+        assert response.status_code == 200
+        # Invalid status is silently ignored per the try/except ValueError in the route
+        assert response.json()["total"] == 1
+
+    def test_list_control_not_found(self):
+        """GET /evidence with nonexistent control_id returns 404."""
+        with patch("compliance.api.evidence_routes.EvidenceRepository"), \
+             patch("compliance.api.evidence_routes.ControlRepository") as MockCtrlRepo:
+            MockCtrlRepo.return_value.get_by_control_id.return_value = None
+            response = client.get("/evidence", params={"control_id": "NONEXISTENT-001"})
+        assert response.status_code == 404
+
+    def test_list_pagination_slices_correctly(self):
+        """Pagination returns correct slice while total reflects full count."""
+        items = [make_evidence({"id": f"e{i}-" + "0" * 32}) for i in range(5)]
+        with patch("compliance.api.evidence_routes.EvidenceRepository") as MockRepo:
+            MockRepo.return_value.get_all.return_value = items
+            response = client.get("/evidence", params={"page": 2, "limit": 2})
+        assert response.status_code == 200
+        data = response.json()
+        assert data["total"] == 5
+        assert len(data["evidence"]) == 2