feat(agent): live OSCAL assessment endpoint POST /api/v1/oscal/assess

Wires ingest (OscalControlsProvider) + assessment (assess) behind an agent
endpoint: pulls the catalog for the target's frameworks (default CRA), loads the
target's findings from the tenant DB, and returns an OSCAL assessment-results
document linking findings to controls.

- BreakpilotConfig (base_url/token/snapshot_dir) from BREAKPILOT_* env; endpoint
  returns 503 when base_url is unset
- handlers::oscal::assess_target on the authenticated (tenant-scoped) router
- test helpers updated for the new config field

clippy -D warnings + fmt + CI test cmd (287+47+27) clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compliance-agent/tests/common/mod.rs

@@ -60,6 +60,7 @@ pub fn dev_config(mongodb_uri: String, db_name: String) -> AgentConfig {
         tenant_registry_url: None,
         plc_runtime: compliance_core::PlcRuntimeConfig::default(),
         werkbank_runner_token: Some(SecretString::from(TEST_RUNNER_TOKEN.to_string())),
+        breakpilot: compliance_core::config::BreakpilotConfig::default(),
     }
 }