feat(backend): On-demand Browser-Verhaltens-Matrix + Snapshot-Persistenz (Phase 2)

- check_snapshot: update_browser_matrix/load_browser_matrix — migrationsfrei
  in banner_result.browser_matrix (JSONB jsonb_set, eigener scanned_at)
- snapshot_check_routes: POST /snapshots/{id}/browser-behavior/run laeuft
  /scan-matrix LIVE (Re-Crawl je Engine, nur live messbar), persistiert das
  Ergebnis; GET /snapshots/{id}/browser-behavior liefert die gespeicherte
  Matrix ohne Re-Crawl. Profil-Set = 4 Default-Engines + Brave/Chrome/Edge.
- consent-tester multi_browser_scanner: Semaphore(2) gegen OOM (7 Browser
  parallel sprengten das 2g-mem_limit)
- Pydantic-Modell mit Optional[List[...]] (nicht `| None`) → Py3.9-sicher
- Tests: _snapshot_scan_url + Request-Defaults (5)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend-compliance/compliance/services/check_snapshot.py

@@ -150,6 +150,52 @@ def load_snapshot(db: Session, snapshot_id: str) -> dict | None:
         return None
 
 
+def update_browser_matrix(db: Session, snapshot_id: str, matrix: dict) -> bool:
+    """Persistiert das Browser-Verhaltens-Matrix-Ergebnis MIGRATIONSFREI in die
+    bestehende `banner_result`-JSONB-Spalte unter dem Key `browser_matrix`.
+
+    Eigener Zeitstempel steckt im Matrix-Objekt (`scanned_at`) — der kann von
+    der Snapshot-Aufnahmezeit abweichen, weil die Matrix on-demand LIVE läuft
+    (Browser-Verhalten ist nur live messbar, anders als die Textmodule)."""
+    try:
+        db.execute(
+            text("""
+                UPDATE compliance.compliance_check_snapshots
+                SET banner_result = jsonb_set(
+                        COALESCE(banner_result, '{}'::jsonb),
+                        '{browser_matrix}', CAST(:bm AS JSONB), true)
+                WHERE id = CAST(:sid AS uuid)
+            """),
+            {"sid": snapshot_id, "bm": _to_jsonb(matrix)},
+        )
+        db.commit()
+        return True
+    except Exception as e:
+        logger.warning("browser-matrix persist failed for %s: %s", snapshot_id, e)
+        try:
+            db.rollback()
+        except Exception:
+            pass
+        return False
+
+
+def load_browser_matrix(db: Session, snapshot_id: str) -> dict | None:
+    """Nur das persistierte `browser_matrix`-Sub-Objekt (kein Re-Crawl)."""
+    try:
+        row = db.execute(
+            text("""
+                SELECT banner_result -> 'browser_matrix'
+                FROM compliance.compliance_check_snapshots
+                WHERE id = CAST(:sid AS uuid)
+            """),
+            {"sid": snapshot_id},
+        ).fetchone()
+        return row[0] if row and row[0] else None
+    except Exception as e:
+        logger.warning("browser-matrix load failed for %s: %s", snapshot_id, e)
+        return None
+
+
 def list_snapshots_for_domain(db: Session, domain: str, limit: int = 20) -> list[dict]:
     """List recent snapshots for a domain (for diff-mode P84)."""
     try: