feat(legal-docs): 5-stage lifecycle (draft → review_internal → review_client → approved → published)

Phase 1 of the workspace-cutover initiative: compliance becomes the
single source of truth for documents. Step one is making the existing
compliance_legal_documents workflow rich enough to express the DSB→
Mandant approval pattern that the workspace's 5-stage UI needed.

Migration 148:
- Adds CHECK constraint on status (was free-form VARCHAR20)
- Allows: draft, review, review_internal, review_client, approved,
  published, archived, rejected (legacy "review" kept for backward
  compat — 0 existing rows so no backfill needed)
- Adds CHECK on approvals.action with extended values:
  submitted_internal, submitted_client, approved_internal,
  approved_client, rejected_internal, rejected_client
- Adds 6 new columns for the richer audit trail: submitted_by/at,
  approved_internal_by/at, approved_client_by/at

Service:
- New methods submit_internal_review, approve_internal, approve_client
- submit_review / approve kept as backwards-compat aliases that map to
  the new methods
- reject() now reads current status to log specific rejected_internal
  or rejected_client action
- _version_to_response includes all new audit fields

Routes:
- POST /versions/{id}/submit-internal-review
- POST /versions/{id}/approve-internal  (DSB sagt OK → Mandant ist dran)
- POST /versions/{id}/approve-client    (Mandant sagt OK → approved)
- Existing submit-review / approve endpoints stay but map through aliases

Schema:
- VersionResponse extended with optional submitted_by/at,
  approved_internal_by/at, approved_client_by/at fields

This unlocks Phase 2 (Generate-All in compliance generator), Phase 3
(Document-Library tab in admin), Phase 4 (workspace cutover — drop its
own document storage and route everything through this lifecycle).

[migration-approved]

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend-compliance/compliance/db/legal_document_models.py

@@ -42,7 +42,14 @@ class LegalDocumentDB(Base):
 
 
 class LegalDocumentVersionDB(Base):
-    """Version of a legal document with Approval-Workflow status."""
+    """Version of a legal document with 5-stage Approval-Workflow.
+
+    Lifecycle:
+      draft → review_internal (DSB-Prüfung)
+            → review_client   (Mandanten-Prüfung)
+            → approved → published
+      (Ablehnung: review_internal/review_client → rejected → zurück zu draft)
+    """
 
     __tablename__ = 'compliance_legal_document_versions'
 
@@ -53,10 +60,21 @@ class LegalDocumentVersionDB(Base):
     title = Column(String(300), nullable=False)
     content = Column(Text, nullable=False)
     summary = Column(Text)
-    status = Column(String(20), default='draft')   # draft|review|approved|published|archived|rejected
+    status = Column(String(20), default='draft')   # draft|review_internal|review_client|approved|published|archived|rejected (+ legacy 'review')
     created_by = Column(String(200))
+
+    # Backwards-compat single approval (legacy 4-stage Flow)
     approved_by = Column(String(200))
     approved_at = Column(DateTime)
+
+    # 5-stage Trail
+    submitted_by = Column(String(200))
+    submitted_at = Column(DateTime)
+    approved_internal_by = Column(String(200))
+    approved_internal_at = Column(DateTime)
+    approved_client_by = Column(String(200))
+    approved_client_at = Column(DateTime)
+
     rejection_reason = Column(Text)
     created_at = Column(DateTime, default=datetime.utcnow, nullable=False)
     updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)