feat(control-generator): 7-stage pipeline for RAG→LLM→Controls generation

Implements the Control Generator Pipeline that systematically generates
canonical security controls from 150k+ RAG chunks across all compliance
collections (BSI, NIST, OWASP, ENISA, EU laws, German laws).

Three license rules enforced throughout:
- Rule 1 (free_use): Laws/Public Domain — original text preserved
- Rule 2 (citation_required): CC-BY/CC-BY-SA — text with citation
- Rule 3 (restricted): BSI/ISO — full reformulation, no source traces

New files:
- Migration 046: job tracking, chunk tracking, blocked sources tables
- control_generator.py: 7-stage pipeline (scan→classify→structure/reform→harmonize→anchor→store→mark)
- anchor_finder.py: RAG + DuckDuckGo open-source reference search
- control_generator_routes.py: REST API (generate, review, stats, blocked-sources)
- test_control_generator.py: license mapping, rule enforcement, anchor filtering tests

Modified:
- __init__.py: register control_generator_router
- route.ts: proxy generator/review/stats endpoints
- page.tsx: Generator modal, stats panel, state filter, review queue, license badges

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/compliance/api/__init__.py

@@ -34,6 +34,7 @@ from .generation_routes import router as generation_router
 from .project_routes import router as project_router
 from .wiki_routes import router as wiki_router
 from .canonical_control_routes import router as canonical_control_router
+from .control_generator_routes import router as control_generator_router
 
 # Include sub-routers
 router.include_router(audit_router)
@@ -69,6 +70,7 @@ router.include_router(generation_router)
 router.include_router(project_router)
 router.include_router(wiki_router)
 router.include_router(canonical_control_router)
+router.include_router(control_generator_router)
 
 __all__ = [
     "router",
@@ -104,4 +106,5 @@ __all__ = [
     "project_router",
     "wiki_router",
     "canonical_control_router",
+    "control_generator_router",
 ]