feat: Mail-Restrukturierung + B22 Cross-Domain-Doc-Detector

User-Feedback BMW v5: "740 Cookies verschwunden auf 31, Übersicht
verloren". Drei Anpassungen:

Mail-Restrukturierung (_executive_summary.py + _compose.py):
  - render_executive_summary(): Top-of-mail TL;DR mit
    Compliance-Score (gross + farbig), Top-3-Findings nach
    Severity, Cookie-Statistik (deklariert/Browser/Drittland),
    Severity-Verteilungs-Chips.
  - collapsible(): wrapt jeden Block in <details>/<summary>.
    Mailpit + alle modernen Mail-Clients rendern das nativ.
  - _compose.py: alle 18+ B-Blöcke + per_doc + per_theme +
    legacy_html in Akkordeons. NUR Critical-Findings + Sofort-
    massnahmen sind immer offen — Reviewer sieht ~15 Zeilen
    Übersicht und klappt selektiv auf.
  - Cookie-Inventar (742) hat jetzt eigene Sektion ganz oben
    (Akkordeon "🍪 Cookie-Inventar"), Vendor-Karten parallel.

B22 Cross-Domain-Legal-Doc-Detector (cross_domain_doc_check.py):
  Real-Beispiel User-Feedback: Elli's AGB liegt auf docs.logpay.de
  statt elli.eco. Detektor erkennt SLD-Mismatch:
  - HIGH bei agb / widerruf (vertragsrelevant)
  - MEDIUM bei dse / nutzungsbedingungen
  - INFO bei cookie / impressum (Best-Practice)
  Norm: DSGVO Art. 28 (AVV-Pflicht für Hosting) + Art. 13 Abs. 1
  lit. e (Empfänger) + § 312i BGB (Cool-URLs).
  9/9 Tests grün inkl. Elli/LogPay Pattern.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/api/agent_check/_b22_wiring.py

@@ -0,0 +1,59 @@
+"""B22 wiring — Cross-Domain-Legal-Doc-Detector."""
+
+from __future__ import annotations
+
+import html
+import logging
+
+from compliance.services.cross_domain_doc_check import check_cross_domain_docs
+
+logger = logging.getLogger(__name__)
+
+
+def run_b22(state: dict) -> None:
+    new = check_cross_domain_docs(state)
+    if not new:
+        return
+    extras = state.get("extra_findings") or []
+    extras.extend(new)
+    state["extra_findings"] = extras
+    state["cross_domain_doc_html"] = _render(new)
+    logger.info("B22 cross-domain: %d finding(s)", len(new))
+
+
+def _render(findings: list[dict]) -> str:
+    cards = []
+    for f in findings:
+        sev = (f.get("severity") or "").upper()
+        color = ("#dc2626" if sev == "HIGH"
+                 else "#f59e0b" if sev == "MEDIUM" else "#64748b")
+        cards.append(
+            f"<div style='margin:12px 0;padding:14px;background:#fff;"
+            f"border-left:3px solid {color};border-radius:4px;'>"
+            f"<div style='font-weight:600;color:{color};font-size:14px;'>"
+            f"{sev} · {html.escape(f.get('check_id') or '')}</div>"
+            f"<div style='font-size:14px;margin-top:4px;'>"
+            f"<strong>{html.escape(f.get('title') or '')}</strong></div>"
+            f"<div style='font-size:12px;color:#64748b;margin-top:2px;'>"
+            f"{html.escape(f.get('norm') or '')}</div>"
+            f"<div style='font-size:12px;color:#475569;margin-top:6px;'>"
+            f"<em>{html.escape(f.get('evidence') or '')}</em></div>"
+            f"<div style='font-size:13px;margin-top:8px;background:#dcfce7;"
+            f"padding:8px 10px;border-radius:4px;'>"
+            f"<strong>→ Empfehlung:</strong> "
+            f"{html.escape(f.get('recommended_action') or '')}</div>"
+            "</div>"
+        )
+    return (
+        "<div style='margin:24px 0;padding:16px;border-left:4px solid #dc2626;"
+        "background:#fef2f2;border-radius:4px;'>"
+        f"<h2 style='margin:0 0 8px;color:#7f1d1d;font-size:16px;'>"
+        f"🌐 Vertragsdoc auf Fremd-Domain ({len(findings)} Fall(e))"
+        "</h2>"
+        "<p style='margin:0 0 8px;font-size:12px;color:#475569;'>"
+        "Vertragsrelevante Dokumente liegen auf einer anderen Second-Level-"
+        "Domain als die Site. AVV-Pflicht + URL-Stabilitäts-Risiko."
+        "</p>"
+        + "".join(cards) +
+        "</div>"
+    )

backend-compliance/compliance/api/agent_check/_orchestrator.py

@@ -31,6 +31,7 @@ from ._b17_wiring import run_b17
 from ._b18_wiring import run_b18
 from ._b19_wiring import run_b19
 from ._b20_wiring import run_b20
+from ._b22_wiring import run_b22
 from ._constants import _compliance_check_jobs
 from ._phase_a_resolve import run_phase_a
 from ._phase_b_profile_check import run_phase_b
@@ -96,6 +97,7 @@ async def run_compliance_check(check_id: str, req) -> None:
         await run_b18(state)  # Impressum-Specialist-Agent (Pattern+LLM)
         run_b19(state)  # Cookie-Coherence (Salesforce-as-essential)
         await run_b20(state)  # Legacy-URL-Discovery (Sitemap+Wayback)
+        run_b22(state)  # Cross-Domain-Legal-Doc-Hosting (Elli/LogPay)
         # Phase D-3 top/mid/bot: Step 5 HTML blocks
         await run_phase_d3_top(state)
         await run_phase_d3_mid(state)