feat(tcf-vendors): GVL cache + vendor extraction + VVT mapping

Phase 1-2 of the closed quality loop:
- GVL cache (consent-tester/services/gvl_cache.py): downloads and caches
  IAB Global Vendor List with 24h TTL, resolves vendor IDs to names,
  purposes, policy URLs, retention, country
- Vendor extraction (consent_interceptor.py): extract_tcf_vendors()
  reads __tcfapi after accept phase, resolves via GVL
- Scan response: tcf_vendors field added to /scan endpoint
- VVT mapper (vendor_vvt_mapper.py): maps TCF vendors to VVT format
  with purpose labels, Rechtsgrundlage, Drittland detection
- Vendor cross-check (banner_cookie_cross_check.py): checks all TCF
  vendors against DSI text — missing vendors, undocumented transfers
- Compliance check integrates Step 3d: TCF vendors vs DSI

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

consent-tester/services/consent_scanner.py

@@ -65,6 +65,8 @@ class ConsentTestResult:
     banner_has_dse_link: bool = False
     # Deep verification (per-phase intercepted data)
     deep_verification: dict = field(default_factory=dict)
+    # TCF vendors (resolved via GVL after accept phase)
+    tcf_vendors: list = field(default_factory=list)
 
 
 async def run_consent_test(
@@ -239,6 +241,13 @@ async def run_consent_test(
             accept_tracking = find_tracking_services(result.accept_scripts)
             result.accept_new_tracking = [t for t in accept_tracking if t not in result.before_tracking]
 
+            # TCF vendor extraction (after accept, while page is still open)
+            try:
+                from services.consent_interceptor import extract_tcf_vendors
+                result.tcf_vendors = await extract_tcf_vendors(page_c)
+            except Exception as exc:
+                logger.warning("TCF vendor extraction failed: %s", exc)
+
             await ctx_c.close()
 
             # ── Phase D-F: Per-category tests ────────────────────────