feat(iace): show ESAW evidence panel in risk view (B1)

The Risikobewertung page only mentioned the data sources as static prose.
Add a collapsible "Datenquellen & Evidenz" panel sourced from
/iace/risk-data-sources: the real Eurostat ESAW 2023 contact-mode shares
per mode, with license + ready-to-print attribution, and the note that
tiers anchor the ordering while values stay GT-calibrated.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

admin-compliance/app/sdk/iace/[projectId]/risikobewertung/_hooks/useRiskDataSources.ts

@@ -0,0 +1,47 @@
+'use client'
+
+import { useEffect, useState } from 'react'
+
+export interface RiskEvidence {
+  mode: string
+  label: string
+  stat: string
+  source: string
+  license: string
+  attribution: string
+  retrieved: string
+}
+
+export interface RiskDataSources {
+  note: string
+  evidence: RiskEvidence[]
+}
+
+/**
+ * Loads the license-tagged public-statistics evidence behind the risk-frequency
+ * anchors (Eurostat ESAW hsw_ph3_08, 2023). Global, not per project — so an
+ * auditor can see WHERE the W/S tiers come from and the source is cited.
+ */
+export function useRiskDataSources() {
+  const [data, setData] = useState<RiskDataSources | null>(null)
+
+  useEffect(() => {
+    let cancelled = false
+    async function load() {
+      try {
+        const res = await fetch('/api/sdk/v1/iace/risk-data-sources')
+        if (!res.ok) return
+        const json = (await res.json()) as RiskDataSources
+        if (!cancelled) setData(json)
+      } catch (err) {
+        console.error('Failed to load risk data sources:', err)
+      }
+    }
+    load()
+    return () => {
+      cancelled = true
+    }
+  }, [])
+
+  return { data }
+}