feat(cra): attach network_security regulatory breadth (shared Controls-API)

Semantic breadth (2): each finding's CRA-AI is mapped to a network_security
sub_topic and enriched with atom-grain, framework-traceable obligations from the
shared Controls-API (compliance.atom_classification) — at the endpoint/view layer
(SessionLocal), NOT in the pure mapper. CRA-AI anchor + curated measure +
NIST/OWASP crosswalk stay the lead; this is breadth + source evidence. Only
network_security is queried (atom-grain), scoped by sub_topic + limit. Frontend
renders it under the collapsible best-practice depth (control_id · title · source).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend-compliance/compliance/api/cra_assess_routes.py

@@ -16,6 +16,8 @@ from pydantic import BaseModel
 
 from compliance.services.cra_finding_mapper import assess_findings_payload
 from compliance.services.cra_snapshot_store import save_snapshot, list_snapshots, get_snapshot
+from compliance.services.cra_use_case_controls import enrich_findings_with_breadth
+from database import SessionLocal
 from .tenant_utils import get_tenant_id
 
 router = APIRouter(prefix="/v1/cra", tags=["cra"])
@@ -59,15 +61,29 @@ def _payload(body: AssessRequest) -> dict:
     }
 
 
+def _assess_enriched(body: AssessRequest) -> dict:
+    """Assessment + the network_security regulatory breadth (atom-grain).
+
+    Breadth is attached at this view layer (db here), never in the pure mapper.
+    """
+    result = assess_findings_payload(_payload(body))
+    db = SessionLocal()
+    try:
+        enrich_findings_with_breadth(result.get("mapped", []), db)
+    finally:
+        db.close()
+    return result
+
+
 @router.post("/assess")
 async def assess(body: AssessRequest):
-    return assess_findings_payload(_payload(body))
+    return _assess_enriched(body)
 
 
 @router.post("/projects/{project_id}/assess-snapshot")
 async def assess_snapshot(project_id: str, body: AssessRequest, tenant_id: str = Depends(get_tenant_id)):
     """Run the assessment and persist it as a versioned snapshot (running system)."""
-    assessment = assess_findings_payload(_payload(body))
+    assessment = _assess_enriched(body)
     snap = save_snapshot(project_id, tenant_id, assessment)
     return {"snapshot": snap, "assessment": assessment}