feat: add RAG corpus versioning and source policy backend

Part 1 — RAG Corpus Versioning:
- New DB table compliance_corpus_versions (migration 017)
- Go CorpusVersionStore with CRUD operations
- Assessment struct extended with corpus_version_id
- API endpoints: GET /rag/corpus-status, /rag/corpus-versions/:collection
- RAG routes (search, regulations) now registered in main.go
- Ingestion script registers corpus versions after each run
- Frontend staleness badge in SDK sidebar

Part 3 — Source Policy Backend:
- New FastAPI router with CRUD for allowed sources, PII rules,
  operations matrix, audit trail, stats, and compliance report
- SQLAlchemy models for all source policy tables (migration 001)
- Frontend API base corrected from edu-search:8088/8089 to
  backend-compliance:8002/api

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ai-compliance-sdk/internal/api/handlers/rag_handlers.go

@@ -9,13 +9,15 @@ import (
 
 // RAGHandlers handles RAG search API endpoints.
 type RAGHandlers struct {
-	ragClient *ucca.LegalRAGClient
+	ragClient          *ucca.LegalRAGClient
+	corpusVersionStore *ucca.CorpusVersionStore
 }
 
 // NewRAGHandlers creates new RAG handlers.
-func NewRAGHandlers() *RAGHandlers {
+func NewRAGHandlers(corpusVersionStore *ucca.CorpusVersionStore) *RAGHandlers {
 	return &RAGHandlers{
-		ragClient: ucca.NewLegalRAGClient(),
+		ragClient:          ucca.NewLegalRAGClient(),
+		corpusVersionStore: corpusVersionStore,
 	}
 }
 
@@ -74,3 +76,62 @@ func (h *RAGHandlers) ListRegulations(c *gin.Context) {
 		"count":       len(regs),
 	})
 }
+
+// CorpusStatus returns the current version status of all RAG collections.
+// GET /sdk/v1/rag/corpus-status
+func (h *RAGHandlers) CorpusStatus(c *gin.Context) {
+	if h.corpusVersionStore == nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "corpus version store not configured"})
+		return
+	}
+
+	versions, err := h.corpusVersionStore.GetAllLatestVersions(c.Request.Context())
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to fetch corpus versions: " + err.Error()})
+		return
+	}
+
+	collections := make(map[string]gin.H)
+	for _, v := range versions {
+		collections[v.CollectionName] = gin.H{
+			"id":              v.ID,
+			"current_version": v.Version,
+			"documents_count": v.DocumentsCount,
+			"chunks_count":    v.ChunksCount,
+			"regulations":     v.Regulations,
+			"last_updated":    v.CreatedAt,
+			"digest":          v.Digest,
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"collections": collections,
+	})
+}
+
+// CorpusVersionHistory returns the version history for a specific collection.
+// GET /sdk/v1/rag/corpus-versions/:collection
+func (h *RAGHandlers) CorpusVersionHistory(c *gin.Context) {
+	if h.corpusVersionStore == nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"error": "corpus version store not configured"})
+		return
+	}
+
+	collection := c.Param("collection")
+	if collection == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "collection name required"})
+		return
+	}
+
+	versions, err := h.corpusVersionStore.ListCorpusVersions(c.Request.Context(), collection)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to fetch corpus versions: " + err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"collection": collection,
+		"versions":   versions,
+		"count":      len(versions),
+	})
+}