feat: Anti-Fake-Evidence System (Phase 1-4b)

Implement full evidence integrity pipeline to prevent compliance theater:
- Confidence levels (E0-E4), truth status tracking, assertion engine
- Four-Eyes approval workflow, audit trail, reject endpoint
- Evidence distribution dashboard, LLM audit routes
- Traceability matrix (backend endpoint + Compliance Hub UI tab)
- Anti-fake badges, control status machine, normative patterns
- 2 migrations, 4 test suites, MkDocs documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/compliance/api/routes.py

@@ -25,6 +25,7 @@ from sqlalchemy.orm import Session
 
 from classroom_engine.database import get_db
 
+from .audit_trail_utils import log_audit_trail
 from ..db import (
     RegulationRepository,
     RequirementRepository,
@@ -595,6 +596,7 @@ async def get_control(control_id: str, db: Session = Depends(get_db)):
         review_frequency_days=control.review_frequency_days,
         status=control.status.value if control.status else None,
         status_notes=control.status_notes,
+        status_justification=control.status_justification,
         last_reviewed_at=control.last_reviewed_at,
         next_review_at=control.next_review_at,
         created_at=control.created_at,
@@ -617,16 +619,52 @@ async def update_control(
 
     update_data = update.model_dump(exclude_unset=True)
 
-    # Convert status string to enum
+    # Convert status string to enum and validate transition
     if "status" in update_data:
         try:
-            update_data["status"] = ControlStatusEnum(update_data["status"])
+            new_status_enum = ControlStatusEnum(update_data["status"])
         except ValueError:
             raise HTTPException(status_code=400, detail=f"Invalid status: {update_data['status']}")
 
+        # Validate status transition (Anti-Fake-Evidence)
+        from ..services.control_status_machine import validate_transition
+        current_status = control.status.value if control.status else "planned"
+        evidence_list = db.query(EvidenceDB).filter(EvidenceDB.control_id == control.id).all()
+        allowed, violations = validate_transition(
+            current_status=current_status,
+            new_status=update_data["status"],
+            evidence_list=evidence_list,
+            status_justification=update_data.get("status_justification") or update_data.get("status_notes"),
+        )
+        if not allowed:
+            raise HTTPException(
+                status_code=409,
+                detail={
+                    "error": "Status transition not allowed",
+                    "current_status": current_status,
+                    "requested_status": update_data["status"],
+                    "violations": violations,
+                }
+            )
+
+        update_data["status"] = new_status_enum
+
     updated = repo.update(control.id, **update_data)
     db.commit()
 
+    # Audit trail for status changes
+    new_status = updated.status.value if updated.status else None
+    if "status" in update.model_dump(exclude_unset=True) and current_status != new_status:
+        log_audit_trail(
+            db, "control", control.id, updated.control_id or updated.title,
+            "status_change",
+            performed_by=update.owner or "system",
+            field_changed="status",
+            old_value=current_status,
+            new_value=new_status,
+        )
+        db.commit()
+
     return ControlResponse(
         id=updated.id,
         control_id=updated.control_id,
@@ -645,6 +683,7 @@ async def update_control(
         review_frequency_days=updated.review_frequency_days,
         status=updated.status.value if updated.status else None,
         status_notes=updated.status_notes,
+        status_justification=updated.status_justification,
         last_reviewed_at=updated.last_reviewed_at,
         next_review_at=updated.next_review_at,
         created_at=updated.created_at,
@@ -690,6 +729,7 @@ async def review_control(
         review_frequency_days=updated.review_frequency_days,
         status=updated.status.value if updated.status else None,
         status_notes=updated.status_notes,
+        status_justification=updated.status_justification,
         last_reviewed_at=updated.last_reviewed_at,
         next_review_at=updated.next_review_at,
         created_at=updated.created_at,