feat: add RAG corpus versioning and source policy backend

Part 1 — RAG Corpus Versioning:
- New DB table compliance_corpus_versions (migration 017)
- Go CorpusVersionStore with CRUD operations
- Assessment struct extended with corpus_version_id
- API endpoints: GET /rag/corpus-status, /rag/corpus-versions/:collection
- RAG routes (search, regulations) now registered in main.go
- Ingestion script registers corpus versions after each run
- Frontend staleness badge in SDK sidebar

Part 3 — Source Policy Backend:
- New FastAPI router with CRUD for allowed sources, PII rules,
  operations matrix, audit trail, stats, and compliance report
- SQLAlchemy models for all source policy tables (migration 001)
- Frontend API base corrected from edu-search:8088/8089 to
  backend-compliance:8002/api

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/main.py

@@ -21,6 +21,9 @@ from dsr_admin_api import router as dsr_admin_router, templates_router as dsr_te
 # Compliance framework sub-package
 from compliance.api import router as compliance_framework_router
 
+# Source Policy
+from compliance.api.source_policy_router import router as source_policy_router
+
 # Middleware
 from middleware import (
     RequestIDMiddleware,
@@ -85,6 +88,9 @@ app.include_router(dsr_templates_router, prefix="/api")
 # Compliance Framework (regulations, controls, evidence, risks, audits, ISMS)
 app.include_router(compliance_framework_router, prefix="/api")
 
+# Source Policy (allowed sources, PII rules, audit)
+app.include_router(source_policy_router, prefix="/api")
+
 
 if __name__ == "__main__":
     import uvicorn