feat: add RAG corpus versioning and source policy backend

Part 1 — RAG Corpus Versioning:
- New DB table compliance_corpus_versions (migration 017)
- Go CorpusVersionStore with CRUD operations
- Assessment struct extended with corpus_version_id
- API endpoints: GET /rag/corpus-status, /rag/corpus-versions/:collection
- RAG routes (search, regulations) now registered in main.go
- Ingestion script registers corpus versions after each run
- Frontend staleness badge in SDK sidebar

Part 3 — Source Policy Backend:
- New FastAPI router with CRUD for allowed sources, PII rules,
  operations matrix, audit trail, stats, and compliance report
- SQLAlchemy models for all source policy tables (migration 001)
- Frontend API base corrected from edu-search:8088/8089 to
  backend-compliance:8002/api

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ai-compliance-sdk/internal/ucca/models.go

@@ -471,6 +471,10 @@ type Assessment struct {
 	Art22Risk               bool            `json:"art22_risk"`
 	TrainingAllowed         TrainingAllowed `json:"training_allowed"`
 
+	// Corpus Versioning (RAG)
+	CorpusVersionID *uuid.UUID `json:"corpus_version_id,omitempty"`
+	CorpusVersion   string     `json:"corpus_version,omitempty"`
+
 	// LLM Explanation (optional)
 	ExplanationText        *string    `json:"explanation_text,omitempty"`
 	ExplanationGeneratedAt *time.Time `json:"explanation_generated_at,omitempty"`