feat(vvt): per-vendor extraction + opt-out check + VVT table in email (V1)

When a known CMP (ePaaS, OneTrust) renders the cookie policy, we now
extract structured vendor records, probe their opt-out + privacy URLs,
score each vendor (0-100), and append a 'VVT-Vorschlag' table to the
compliance email — one row per vendor, sortable by compliance score.

consent-tester:
- DSIDiscoveryResult.cmp_payloads: surfaces raw CMP JSON to callers
- DSIDiscoveryResponse: new cmp_payloads field
- discover_dsi_documents sets cmp_payloads from cmp_capture
- cmp_library/{epaas,onetrust}.py: new extract_vendors(d) returning
  list[VendorRecord]

backend:
- _fetch_text() now returns (text, cmp_payloads) tuple
- doc_entries store cmp_payloads per doc (mostly cookie)
- _autodiscover_missing forwards homepage payloads to the cookie entry
- New module vendor_extractor.py: dispatches ePaaS/OneTrust/generic
  schemas; dedupes vendors across multiple payloads
- cookie_link_validator.py extended with validate_vendor_urls(vendors)
  and score_vendors(vendors) — 0-100 score per vendor based on name,
  purpose, country, opt-out reachable, privacy URL reachable, cookies
  with names + expiry
- agent_doc_check_extras.build_vvt_table_html: renders the table
- Route appends VVT HTML after the provider list, before the
  document-by-document report
- Response JSON gains cmp_vendors for future frontend rendering

Example for BMW: ~30 ePaaS providers → table with Name | Kategorie |
Sitz | Cookies | Opt-Out (✓/✗) | Privacy (✓/✗) | Score. Sorted by
score ascending so the worst-compliant vendors are at the top.

backend-compliance/compliance/api/agent_doc_check_extras.py

@@ -229,4 +229,105 @@ def _category_label(kat: str) -> str:
         "functional": "Funktional",
         "statistics": "Statistik",
         "marketing": "Marketing",
+        "strictlyNecessary": "Notwendig",
+        "advertising": "Marketing",
     }.get(kat, kat or "—")
+
+
+def build_vvt_table_html(vendors: list[dict]) -> str:
+    """Render the per-vendor VVT-style table for the email report.
+
+    One row per vendor. Columns: Name | Kategorie | Sitz | Cookies |
+    Opt-Out (Status) | Privacy (Status) | Compliance-Score.
+
+    Vendors are expected to come from vendor_extractor.extract_vendors_from_payloads
+    and have already been scored by cookie_link_validator.score_vendors.
+    """
+    if not vendors:
+        return ""
+
+    vendors = sorted(vendors, key=lambda v: v.get("compliance_score", 0))
+    rows: list[str] = []
+    for v in vendors:
+        name = v.get("name") or "Unbekannt"
+        category = _category_label(v.get("category", ""))
+        country = v.get("country") or "—"
+        cookies = v.get("cookies") or []
+        n_cookies = len(cookies)
+        score = int(v.get("compliance_score", 0))
+        flags = v.get("compliance_flags") or []
+
+        opt_status = _link_status_badge(
+            v.get("opt_out_url"), v.get("opt_out_ok"),
+            v.get("opt_out_status"),
+        )
+        privacy_status = _link_status_badge(
+            v.get("privacy_policy_url"), v.get("privacy_ok"),
+            v.get("privacy_status"),
+        )
+
+        score_color = ("#16a34a" if score >= 80 else
+                       "#d97706" if score >= 50 else "#dc2626")
+        flag_str = ""
+        if flags:
+            flag_str = (
+                f'<div style="font-size:10px;color:#94a3b8;margin-top:2px">'
+                f'{", ".join(flags[:4])}</div>'
+            )
+        rows.append(
+            f'<tr style="border-top:1px solid #e2e8f0">'
+            f'<td style="padding:6px 8px;color:#1e293b;font-size:11px">'
+            f'{name}{flag_str}</td>'
+            f'<td style="padding:6px 8px;color:#475569;font-size:11px">{category}</td>'
+            f'<td style="padding:6px 8px;color:#475569;font-size:11px">{country}</td>'
+            f'<td style="padding:6px 8px;text-align:center;color:#475569;font-size:11px">'
+            f'{n_cookies}</td>'
+            f'<td style="padding:6px 8px;text-align:center">{opt_status}</td>'
+            f'<td style="padding:6px 8px;text-align:center">{privacy_status}</td>'
+            f'<td style="padding:6px 8px;text-align:right;font-weight:600;'
+            f'color:{score_color};font-size:11px">{score}%</td>'
+            f'</tr>'
+        )
+
+    n_total = len(vendors)
+    n_critical = sum(1 for v in vendors if v.get("compliance_score", 0) < 50)
+    summary = (
+        f"{n_total} Anbieter erfasst"
+        + (f", <strong style=\"color:#dc2626\">{n_critical} unter 50%</strong>"
+           if n_critical else " — alle ueber 50%")
+    )
+
+    return (
+        '<div style="font-family:-apple-system,BlinkMacSystemFont,sans-serif;'
+        'max-width:760px;margin:0 auto 16px;padding:12px 16px;'
+        'background:#fafafa;border:1px solid #e5e7eb;border-radius:8px">'
+        '<h3 style="margin:0 0 4px;font-size:14px;color:#334155">'
+        'VVT-Vorschlag: Drittanbieter aus Cookie-Richtlinie</h3>'
+        f'<p style="margin:0 0 10px;font-size:11px;color:#6b7280">{summary}. '
+        'Sortiert nach Compliance-Score (niedrig zuerst — diese Eintraege '
+        'pruefen).</p>'
+        '<table style="width:100%;border-collapse:collapse;font-size:11px">'
+        '<thead><tr style="background:#f1f5f9;color:#475569;text-align:left">'
+        '<th style="padding:5px 8px">Name</th>'
+        '<th style="padding:5px 8px">Kategorie</th>'
+        '<th style="padding:5px 8px">Sitz</th>'
+        '<th style="padding:5px 8px;text-align:center">Cookies</th>'
+        '<th style="padding:5px 8px;text-align:center">Opt-Out</th>'
+        '<th style="padding:5px 8px;text-align:center">Privacy</th>'
+        '<th style="padding:5px 8px;text-align:right">Score</th>'
+        '</tr></thead><tbody>'
+        + "".join(rows)
+        + '</tbody></table></div>'
+    )
+
+
+def _link_status_badge(url: str | None, ok: bool | None, status: int | None) -> str:
+    if not url:
+        return ('<span style="color:#dc2626;font-size:11px" title="Kein Link">'
+                '&#10007;</span>')
+    if ok:
+        return ('<span style="color:#16a34a;font-size:11px" '
+                f'title="HTTP {status}">&#10003;</span>')
+    status_str = str(status) if status else "?"
+    return ('<span style="color:#dc2626;font-size:11px" '
+            f'title="HTTP {status_str}">&#10007; ({status_str})</span>')