feat(cra): versioned assessment snapshots — CRA Art. 13 running system (step 3)

Persist each CRA assessment as a versioned, auditable snapshot over the product
lifecycle. Reuses the existing compliance_cra_documents table (NO new schema,
frozen DB respected): doc_type='doc_risk_assessment', full assessment in
generation_context, requirements_coverage summary, auto-incrementing version,
prior version superseded. New endpoints: POST /projects/{id}/assess-snapshot,
GET /projects/{id}/assess-snapshots (history), GET /assess-snapshots/{id}.
Additive (no contract baseline change).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend-compliance/compliance/api/cra_assess_routes.py

@@ -11,10 +11,12 @@ tested mapper; no DB, no LLM, no RAG. Same logic the MCP server exposes.
 """
 from typing import Dict, List, Optional
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel
 
 from compliance.services.cra_finding_mapper import assess_findings_payload
+from compliance.services.cra_snapshot_store import save_snapshot, list_snapshots, get_snapshot
+from .tenant_utils import get_tenant_id
 
 router = APIRouter(prefix="/v1/cra", tags=["cra"])
 
@@ -49,11 +51,35 @@ class AssessRequest(BaseModel):
     safety_functions: Optional[List[SafetyFunctionIn]] = None
 
 
-@router.post("/assess")
-async def assess(body: AssessRequest):
-    payload = {
+def _payload(body: AssessRequest) -> dict:
+    return {
         "findings": [f.model_dump() for f in body.findings],
         "weights": body.weights,
         "safety_functions": [s.model_dump() for s in body.safety_functions] if body.safety_functions else None,
     }
-    return assess_findings_payload(payload)
+
+
+@router.post("/assess")
+async def assess(body: AssessRequest):
+    return assess_findings_payload(_payload(body))
+
+
+@router.post("/projects/{project_id}/assess-snapshot")
+async def assess_snapshot(project_id: str, body: AssessRequest, tenant_id: str = Depends(get_tenant_id)):
+    """Run the assessment and persist it as a versioned snapshot (running system)."""
+    assessment = assess_findings_payload(_payload(body))
+    snap = save_snapshot(project_id, tenant_id, assessment)
+    return {"snapshot": snap, "assessment": assessment}
+
+
+@router.get("/projects/{project_id}/assess-snapshots")
+async def list_assess_snapshots(project_id: str, tenant_id: str = Depends(get_tenant_id)):
+    return {"snapshots": list_snapshots(project_id, tenant_id)}
+
+
+@router.get("/assess-snapshots/{snapshot_id}")
+async def get_assess_snapshot(snapshot_id: str, tenant_id: str = Depends(get_tenant_id)):
+    snap = get_snapshot(snapshot_id, tenant_id)
+    if not snap:
+        raise HTTPException(status_code=404, detail="Snapshot not found")
+    return snap