chore(cra): align CRA module to the dev/demo tenant + demo-customer seed script

CRA frontend pages hardcoded tenant 00000000-…-001 while IACE uses the dev
tenant 9282a473-… → a demo customer was split/invisible across modules. Align all
app/sdk/cra pages to 9282a473-… so the whole CRA<->IACE journey lives under ONE
tenant. Add scripts/seed_demo_customer.py: seeds CompanyProfile + IACE project
(components, hazards, mitigations) + CRA project (intake, scope-check, assessment
snapshot from faked repo findings + components + safety functions) — the source-
repo layer is faked so the full frontend is walkable once.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

admin-compliance/app/sdk/cra/[projectId]/backlog/page.tsx

@@ -39,7 +39,7 @@ export default function BacklogPage({
   const load = useCallback(async () => {
     try {
       const res = await fetch(`/api/sdk/v1/cra/projects/${projectId}/backlog`, {
-        headers: { 'X-Tenant-ID': '00000000-0000-0000-0000-000000000001' },
+        headers: { 'X-Tenant-ID': '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e' },
       })
       if (!res.ok) throw new Error(await res.text())
       setData(await res.json())

admin-compliance/app/sdk/cra/[projectId]/checks/page.tsx

@@ -39,7 +39,7 @@ export default function ChecksPage({
   const [running, setRunning] = useState<string | null>(null)
   const [urlInputs, setUrlInputs] = useState<Record<string, string>>({})
 
-  const tenant = '00000000-0000-0000-0000-000000000001'
+  const tenant = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
 
   const load = useCallback(async () => {
     try {

admin-compliance/app/sdk/cra/[projectId]/documents/page.tsx

@@ -61,7 +61,7 @@ export default function DocumentsPage({
   const [approving, setApproving] = useState<string | null>(null)
   const [signedBy, setSignedBy] = useState('')
 
-  const tenant = '00000000-0000-0000-0000-000000000001'
+  const tenant = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
 
   const load = useCallback(async () => {
     try {

admin-compliance/app/sdk/cra/[projectId]/intake/page.tsx

@@ -54,7 +54,7 @@ export default function IntakePage({
   const [isCriticalInfra, setIsCriticalInfra] = useState(false)
   const [intendedUse, setIntendedUse] = useState('')
 
-  const tenant = '00000000-0000-0000-0000-000000000001'
+  const tenant = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
 
   const load = useCallback(async () => {
     try {

admin-compliance/app/sdk/cra/[projectId]/monitoring/page.tsx

@@ -30,7 +30,7 @@ export default function MonitoringPage({
   const load = useCallback(async () => {
     try {
       const res = await fetch(`/api/sdk/v1/cra/projects/${projectId}/monitoring`, {
-        headers: { 'X-Tenant-ID': '00000000-0000-0000-0000-000000000001' },
+        headers: { 'X-Tenant-ID': '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e' },
       })
       if (!res.ok) throw new Error(await res.text())
       setData(await res.json())

admin-compliance/app/sdk/cra/[projectId]/page.tsx

@@ -59,7 +59,7 @@ export default function CRAProjectDashboard({
 
   const load = useCallback(async () => {
     try {
-      const headers = { 'X-Tenant-ID': '00000000-0000-0000-0000-000000000001' }
+      const headers = { 'X-Tenant-ID': '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e' }
       const [projRes, backlogRes] = await Promise.all([
         fetch(`/api/sdk/v1/cra/projects/${projectId}`, { headers }),
         fetch(`/api/sdk/v1/cra/projects/${projectId}/backlog`, { headers }),

admin-compliance/app/sdk/cra/[projectId]/path/page.tsx

@@ -100,7 +100,7 @@ export default function PathSelectPage({
   const [saving, setSaving] = useState(false)
   const [error, setError] = useState('')
 
-  const tenant = '00000000-0000-0000-0000-000000000001'
+  const tenant = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
 
   const load = useCallback(async () => {
     try {

admin-compliance/app/sdk/cra/[projectId]/requirements/page.tsx

@@ -42,7 +42,7 @@ export default function RequirementsPage({
   const load = useCallback(async () => {
     try {
       const res = await fetch(`/api/sdk/v1/cra/projects/${projectId}/requirements`, {
-        headers: { 'X-Tenant-ID': '00000000-0000-0000-0000-000000000001' },
+        headers: { 'X-Tenant-ID': '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e' },
       })
       if (!res.ok) throw new Error(await res.text())
       setData(await res.json())

admin-compliance/app/sdk/cra/[projectId]/sbom/page.tsx

@@ -32,7 +32,7 @@ export default function SBOMPage({
   const [uploading, setUploading] = useState(false)
   const [error, setError] = useState('')
   const fileRef = useRef<HTMLInputElement>(null)
-  const tenant = '00000000-0000-0000-0000-000000000001'
+  const tenant = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
 
   const load = useCallback(async () => {
     try {

admin-compliance/app/sdk/cra/[projectId]/scope/page.tsx

@@ -38,7 +38,7 @@ export default function ScopeCheckPage({
   const [checking, setChecking] = useState(false)
   const [error, setError] = useState('')
 
-  const tenant = '00000000-0000-0000-0000-000000000001'
+  const tenant = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
 
   const load = useCallback(async () => {
     try {

admin-compliance/app/sdk/cra/[projectId]/vuln/page.tsx

@@ -89,7 +89,7 @@ export default function VulnPage({
   const [reporterSource, setReporterSource] = useState('internal')
   const [reporterContact, setReporterContact] = useState('')
 
-  const tenant = '00000000-0000-0000-0000-000000000001'
+  const tenant = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
 
   const load = useCallback(async () => {
     try {

admin-compliance/app/sdk/cra/page.tsx

@@ -47,7 +47,7 @@ export default function CRAProjectsPage() {
   const [newDescription, setNewDescription] = useState('')
   const [creating, setCreating] = useState(false)
 
-  const tenantHeader = '00000000-0000-0000-0000-000000000001'
+  const tenantHeader = '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
 
   const loadProjects = useCallback(async () => {
     try {