chore: mypy fixes for routes.py + legal_document_service + control_export_service

- Add [mypy-compliance.api.routes] to mypy.ini strict scope
- Fix bare `dict` type annotation in routes.py update_requirement handler
- Fix Column[str] return type in control_export_service.download_file
- Fix unused type:ignore in legal_document_service.upload_word
- Add union-attr ignore for optional requirement null access in routes.py

mypy compliance/ -> Success on 149 source files
173/173 pytest pass

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/api/routes.py

@@ -167,7 +167,7 @@ async def get_requirement(
             rag = get_rag_client()
             assistant = AIComplianceAssistant()
             query = (
-                f"{requirement.title} {requirement.article or ''}"
+                f"{requirement.title} {requirement.article or ''}"  # type: ignore[union-attr]
             )
             collection = assistant._collection_for_regulation(
                 regulation.code if regulation else ""
@@ -250,7 +250,7 @@ async def delete_requirement(
 @router.put("/requirements/{requirement_id}")
 async def update_requirement(
     requirement_id: str,
-    updates: dict,
+    updates: dict[str, Any],
     svc: RegulationRequirementService = Depends(get_reg_req_service),
 ) -> dict[str, Any]:
     """Update a requirement with implementation/audit details."""