refactor(backend/api): split schemas.py into per-domain modules (1899 -> 39 LOC shim)

Phase 1 Step 3 of PHASE1_RUNBOOK.md. compliance/api/schemas.py is
decomposed into 16 per-domain Pydantic schema modules under
compliance/schemas/:

  common.py          ( 79) — 6 API enums + PaginationMeta
  regulation.py      ( 52)
  requirement.py     ( 80)
  control.py         (119) — Control + Mapping
  evidence.py        ( 66)
  risk.py            ( 79)
  ai_system.py       ( 63)
  dashboard.py       (195) — Dashboard, Export, Executive Dashboard
  service_module.py  (121)
  bsi.py             ( 58) — BSI + PDF extraction
  audit_session.py   (172)
  report.py          ( 53)
  isms_governance.py (343) — Scope, Context, Policy, Objective, SoA
  isms_audit.py      (431) — Finding, CAPA, Review, Internal Audit, Readiness, Trail, ISO27001
  vvt.py             (168)
  tom.py             ( 71)

compliance/api/schemas.py becomes a 39-line re-export shim so existing
imports (from compliance.api.schemas import RegulationResponse) keep
working unchanged. New code should import from the domain module
directly (from compliance.schemas.regulation import RegulationResponse).

Deferred-from-sweep: all 28 class Config blocks in the original file
were converted to model_config = ConfigDict(...) during the split.
schemas.py-sourced PydanticDeprecatedSince20 warnings are now gone.

Cross-domain references handled via targeted imports (e.g. dashboard.py
imports EvidenceResponse from evidence, RiskResponse from risk). common
API enums + PaginationMeta are imported by every domain module.

Verified:
  - 173/173 pytest compliance/tests/ tests/contracts/ pass
  - OpenAPI 360 paths / 484 operations unchanged (contract test green)
  - All new files under the 500-line hard cap (largest: isms_audit.py
    at 431, isms_governance.py at 343, dashboard.py at 195)
  - No file in compliance/schemas/ or compliance/api/schemas.py
    exceeds the hard cap

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/schemas/control.py

@@ -0,0 +1,119 @@
+"""
+Control and ControlMapping Pydantic schemas — extracted from compliance/api/schemas.py.
+
+Phase 1 Step 3: the monolithic ``compliance.api.schemas`` module is being
+split per domain under ``compliance.schemas``. This module is re-exported
+from ``compliance.api.schemas`` for backwards compatibility.
+"""
+
+from datetime import datetime, date
+from typing import Optional, List, Any, Dict
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from compliance.schemas.common import (
+    PaginationMeta, RegulationType, ControlType, ControlDomain,
+    ControlStatus, RiskLevel, EvidenceStatus,
+)
+
+
+# ============================================================================
+# Control Schemas
+# ============================================================================
+
+class ControlBase(BaseModel):
+    control_id: str
+    domain: str
+    control_type: str
+    title: str
+    description: Optional[str] = None
+    pass_criteria: str
+    implementation_guidance: Optional[str] = None
+    code_reference: Optional[str] = None
+    documentation_url: Optional[str] = None
+    is_automated: bool = False
+    automation_tool: Optional[str] = None
+    automation_config: Optional[Dict[str, Any]] = None
+    owner: Optional[str] = None
+    review_frequency_days: int = 90
+
+
+class ControlCreate(ControlBase):
+    pass
+
+
+class ControlUpdate(BaseModel):
+    title: Optional[str] = None
+    description: Optional[str] = None
+    pass_criteria: Optional[str] = None
+    implementation_guidance: Optional[str] = None
+    code_reference: Optional[str] = None
+    documentation_url: Optional[str] = None
+    is_automated: Optional[bool] = None
+    automation_tool: Optional[str] = None
+    automation_config: Optional[Dict[str, Any]] = None
+    owner: Optional[str] = None
+    status: Optional[str] = None
+    status_notes: Optional[str] = None
+
+
+class ControlResponse(ControlBase):
+    id: str
+    status: str
+    status_notes: Optional[str] = None
+    last_reviewed_at: Optional[datetime] = None
+    next_review_at: Optional[datetime] = None
+    created_at: datetime
+    updated_at: datetime
+    evidence_count: Optional[int] = None
+    requirement_count: Optional[int] = None
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class ControlListResponse(BaseModel):
+    controls: List[ControlResponse]
+    total: int
+
+
+class PaginatedControlResponse(BaseModel):
+    """Paginated response for controls - optimized for large datasets."""
+    data: List[ControlResponse]
+    pagination: PaginationMeta
+
+
+class ControlReviewRequest(BaseModel):
+    status: str
+    status_notes: Optional[str] = None
+
+
+# ============================================================================
+# Control Mapping Schemas
+# ============================================================================
+
+class MappingBase(BaseModel):
+    requirement_id: str
+    control_id: str
+    coverage_level: str = "full"
+    notes: Optional[str] = None
+
+
+class MappingCreate(MappingBase):
+    pass
+
+
+class MappingResponse(MappingBase):
+    id: str
+    requirement_article: Optional[str] = None
+    requirement_title: Optional[str] = None
+    control_control_id: Optional[str] = None
+    control_title: Optional[str] = None
+    created_at: datetime
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class MappingListResponse(BaseModel):
+    mappings: List[MappingResponse]
+    total: int
+