feat(tcf-vendors): GVL cache + vendor extraction + VVT mapping

Phase 1-2 of the closed quality loop:
- GVL cache (consent-tester/services/gvl_cache.py): downloads and caches
  IAB Global Vendor List with 24h TTL, resolves vendor IDs to names,
  purposes, policy URLs, retention, country
- Vendor extraction (consent_interceptor.py): extract_tcf_vendors()
  reads __tcfapi after accept phase, resolves via GVL
- Scan response: tcf_vendors field added to /scan endpoint
- VVT mapper (vendor_vvt_mapper.py): maps TCF vendors to VVT format
  with purpose labels, Rechtsgrundlage, Drittland detection
- Vendor cross-check (banner_cookie_cross_check.py): checks all TCF
  vendors against DSI text — missing vendors, undocumented transfers
- Compliance check integrates Step 3d: TCF vendors vs DSI

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/api/agent_compliance_check_routes.py

@@ -258,16 +258,29 @@ async def _run_compliance_check(check_id: str, req: ComplianceCheckRequest):
                 banner_result, doc_texts["cookie"],
             )
             if cross_findings:
-                # Add cross-check findings to cookie results
                 for r in results:
                     if r.doc_type == "cookie":
                         for cf in cross_findings:
                             r.checks.append(CheckItem(**cf))
-                        # Recompute
                         l2 = [c for c in r.checks if c.level == 2 and not c.skipped]
                         l2p = sum(1 for c in l2 if c.passed)
                         r.correctness_pct = round(l2p / len(l2) * 100) if l2 else 0
 
+        # Step 3d: TCF Vendor cross-check against DSI
+        tcf_vendors = banner_result.get("tcf_vendors", []) if banner_result else []
+        vvt_entries: list[dict] = []
+        if tcf_vendors and "dse" in doc_texts:
+            _update(check_id, f"{len(tcf_vendors)} TCF-Verarbeiter vs. DSI abgleichen...")
+            from compliance.services.banner_cookie_cross_check import cross_check_vendors_vs_dsi
+            from compliance.services.vendor_vvt_mapper import map_vendors_to_vvt
+            vendor_findings = cross_check_vendors_vs_dsi(tcf_vendors, doc_texts["dse"])
+            if vendor_findings:
+                for r in results:
+                    if r.doc_type == "dse":
+                        for vf in vendor_findings:
+                            r.checks.append(CheckItem(**vf))
+            vvt_entries = map_vendors_to_vvt(tcf_vendors)
+
         # Step 4: Extract profile hints from documents
         _update(check_id, "Profil wird aus Dokumenten extrahiert...")
         from compliance.services.profile_extractor import extract_profile_from_documents
@@ -307,7 +320,9 @@ async def _run_compliance_check(check_id: str, req: ComplianceCheckRequest):
                 "detected": banner_result.get("banner_detected", False) if banner_result else False,
                 "provider": banner_result.get("banner_provider", "") if banner_result else "",
                 "violations": len(banner_result.get("banner_checks", {}).get("violations", [])) if banner_result else 0,
+                "tcf_vendor_count": len(tcf_vendors),
             } if banner_result else None,
+            "tcf_vendors": vvt_entries if tcf_vendors else [],
             "total_documents": len(results),
             "total_findings": total_findings,
             "email_status": email_result.get("status", "failed"),