refactor(backend/api): split schemas.py into per-domain modules (1899 -> 39 LOC shim)

Phase 1 Step 3 of PHASE1_RUNBOOK.md. compliance/api/schemas.py is
decomposed into 16 per-domain Pydantic schema modules under
compliance/schemas/:

  common.py          ( 79) — 6 API enums + PaginationMeta
  regulation.py      ( 52)
  requirement.py     ( 80)
  control.py         (119) — Control + Mapping
  evidence.py        ( 66)
  risk.py            ( 79)
  ai_system.py       ( 63)
  dashboard.py       (195) — Dashboard, Export, Executive Dashboard
  service_module.py  (121)
  bsi.py             ( 58) — BSI + PDF extraction
  audit_session.py   (172)
  report.py          ( 53)
  isms_governance.py (343) — Scope, Context, Policy, Objective, SoA
  isms_audit.py      (431) — Finding, CAPA, Review, Internal Audit, Readiness, Trail, ISO27001
  vvt.py             (168)
  tom.py             ( 71)

compliance/api/schemas.py becomes a 39-line re-export shim so existing
imports (from compliance.api.schemas import RegulationResponse) keep
working unchanged. New code should import from the domain module
directly (from compliance.schemas.regulation import RegulationResponse).

Deferred-from-sweep: all 28 class Config blocks in the original file
were converted to model_config = ConfigDict(...) during the split.
schemas.py-sourced PydanticDeprecatedSince20 warnings are now gone.

Cross-domain references handled via targeted imports (e.g. dashboard.py
imports EvidenceResponse from evidence, RiskResponse from risk). common
API enums + PaginationMeta are imported by every domain module.

Verified:
  - 173/173 pytest compliance/tests/ tests/contracts/ pass
  - OpenAPI 360 paths / 484 operations unchanged (contract test green)
  - All new files under the 500-line hard cap (largest: isms_audit.py
    at 431, isms_governance.py at 343, dashboard.py at 195)
  - No file in compliance/schemas/ or compliance/api/schemas.py
    exceeds the hard cap

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/schemas/ai_system.py

@@ -0,0 +1,63 @@
+"""
+AI System (AI Act) Pydantic schemas — extracted from compliance/api/schemas.py.
+
+Phase 1 Step 3: the monolithic ``compliance.api.schemas`` module is being
+split per domain under ``compliance.schemas``. This module is re-exported
+from ``compliance.api.schemas`` for backwards compatibility.
+"""
+
+from datetime import datetime, date
+from typing import Optional, List, Any, Dict
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from compliance.schemas.common import (
+    PaginationMeta, RegulationType, ControlType, ControlDomain,
+    ControlStatus, RiskLevel, EvidenceStatus,
+)
+
+
+# ============================================================================
+# AI System Schemas (AI Act Compliance)
+# ============================================================================
+
+class AISystemBase(BaseModel):
+    name: str
+    description: Optional[str] = None
+    purpose: Optional[str] = None
+    sector: Optional[str] = None
+    classification: str = "unclassified"
+    status: str = "draft"
+    obligations: Optional[List[str]] = None
+
+
+class AISystemCreate(AISystemBase):
+    pass
+
+
+class AISystemUpdate(BaseModel):
+    name: Optional[str] = None
+    description: Optional[str] = None
+    purpose: Optional[str] = None
+    sector: Optional[str] = None
+    classification: Optional[str] = None
+    status: Optional[str] = None
+    obligations: Optional[List[str]] = None
+
+
+class AISystemResponse(AISystemBase):
+    id: str
+    assessment_date: Optional[datetime] = None
+    assessment_result: Optional[Dict[str, Any]] = None
+    risk_factors: Optional[List[Dict[str, Any]]] = None
+    recommendations: Optional[List[str]] = None
+    created_at: datetime
+    updated_at: datetime
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class AISystemListResponse(BaseModel):
+    systems: List[AISystemResponse]
+    total: int
+