feat: Obligation-Deduplizierung — 34.617 Duplikate als 'duplicate' markiert

Neue Endpunkte POST /obligations/dedup und GET /obligations/dedup-stats.
Pro candidate_id wird der aelteste Eintrag behalten, alle weiteren erhalten
release_state='duplicate' mit merged_into_id + quality_flags fuer Traceability.
Detail-View filtert Duplikate aus. MKDocs aktualisiert.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend-compliance/tests/test_canonical_control_routes.py

@@ -462,3 +462,86 @@ class TestControlsMeta:
         assert "category_counts" in data
         assert "evidence_type_counts" in data
         assert "release_state_counts" in data
+
+
+class TestObligationDedup:
+    """Tests for obligation deduplication endpoints."""
+
+    @patch("compliance.api.canonical_control_routes.SessionLocal")
+    def test_dedup_dry_run(self, mock_cls):
+        db = MagicMock()
+        db.__enter__ = MagicMock(return_value=db)
+        db.__exit__ = MagicMock(return_value=False)
+        mock_cls.return_value = db
+
+        # Mock: 2 duplicate groups
+        dup_row1 = MagicMock(candidate_id="OC-AUTH-001-01", cnt=3)
+        dup_row2 = MagicMock(candidate_id="OC-AUTH-001-02", cnt=2)
+
+        # Entries for group 1
+        import uuid
+        uid1 = uuid.uuid4()
+        uid2 = uuid.uuid4()
+        uid3 = uuid.uuid4()
+        entry1 = MagicMock(id=uid1, candidate_id="OC-AUTH-001-01", obligation_text="Text A", release_state="composed", created_at=datetime(2026, 1, 1, tzinfo=timezone.utc))
+        entry2 = MagicMock(id=uid2, candidate_id="OC-AUTH-001-01", obligation_text="Text B", release_state="composed", created_at=datetime(2026, 1, 2, tzinfo=timezone.utc))
+        entry3 = MagicMock(id=uid3, candidate_id="OC-AUTH-001-01", obligation_text="Text C", release_state="composed", created_at=datetime(2026, 1, 3, tzinfo=timezone.utc))
+
+        # Entries for group 2
+        uid4 = uuid.uuid4()
+        uid5 = uuid.uuid4()
+        entry4 = MagicMock(id=uid4, candidate_id="OC-AUTH-001-02", obligation_text="Text D", release_state="composed", created_at=datetime(2026, 1, 1, tzinfo=timezone.utc))
+        entry5 = MagicMock(id=uid5, candidate_id="OC-AUTH-001-02", obligation_text="Text E", release_state="composed", created_at=datetime(2026, 1, 2, tzinfo=timezone.utc))
+
+        # Side effects: 1) dup groups, 2) total count, 3) entries grp1, 4) entries grp2
+        mock_result_groups = MagicMock()
+        mock_result_groups.fetchall.return_value = [dup_row1, dup_row2]
+        mock_result_total = MagicMock()
+        mock_result_total.scalar.return_value = 2
+        mock_result_entries1 = MagicMock()
+        mock_result_entries1.fetchall.return_value = [entry1, entry2, entry3]
+        mock_result_entries2 = MagicMock()
+        mock_result_entries2.fetchall.return_value = [entry4, entry5]
+
+        db.execute.side_effect = [mock_result_groups, mock_result_total, mock_result_entries1, mock_result_entries2]
+
+        resp = _client.post("/api/compliance/v1/canonical/obligations/dedup?dry_run=true")
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["dry_run"] is True
+        assert data["stats"]["total_duplicate_groups"] == 2
+        assert data["stats"]["kept"] == 2
+        assert data["stats"]["marked_duplicate"] == 3  # 2 from grp1 + 1 from grp2
+        # Dry run: no commit
+        db.commit.assert_not_called()
+
+    @patch("compliance.api.canonical_control_routes.SessionLocal")
+    def test_dedup_stats(self, mock_cls):
+        db = MagicMock()
+        db.__enter__ = MagicMock(return_value=db)
+        db.__exit__ = MagicMock(return_value=False)
+        mock_cls.return_value = db
+
+        # total, by_state, dup_groups, removable
+        mock_total = MagicMock()
+        mock_total.scalar.return_value = 76046
+        mock_states = MagicMock()
+        mock_states.fetchall.return_value = [
+            MagicMock(release_state="composed", cnt=41217),
+            MagicMock(release_state="duplicate", cnt=34829),
+        ]
+        mock_dup_groups = MagicMock()
+        mock_dup_groups.scalar.return_value = 0
+        mock_removable = MagicMock()
+        mock_removable.scalar.return_value = 0
+
+        db.execute.side_effect = [mock_total, mock_states, mock_dup_groups, mock_removable]
+
+        resp = _client.get("/api/compliance/v1/canonical/obligations/dedup-stats")
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["total_obligations"] == 76046
+        assert data["by_state"]["composed"] == 41217
+        assert data["by_state"]["duplicate"] == 34829
+        assert data["pending_duplicate_groups"] == 0
+        assert data["pending_removable_duplicates"] == 0