feat(agent): live OSCAL assessment endpoint POST /api/v1/oscal/assess

Wires ingest (OscalControlsProvider) + assessment (assess) behind an agent
endpoint: pulls the catalog for the target's frameworks (default CRA), loads the
target's findings from the tenant DB, and returns an OSCAL assessment-results
document linking findings to controls.

- BreakpilotConfig (base_url/token/snapshot_dir) from BREAKPILOT_* env; endpoint
  returns 503 when base_url is unset
- handlers::oscal::assess_target on the authenticated (tenant-scoped) router
- test helpers updated for the new config field

clippy -D warnings + fmt + CI test cmd (287+47+27) clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compliance-core/src/config.rs

@@ -58,6 +58,33 @@ pub struct AgentConfig {
     /// jobs — NOT a Keycloak JWT, since a runner acts across tenants. When
     /// `None`, those endpoints are not mounted at all.
     pub werkbank_runner_token: Option<SecretString>,
+    /// Source for the OSCAL control catalog pulled from breakpilot-compliance
+    /// (drives the [`crate::traits::ControlsProvider`]). Disabled when
+    /// `base_url` is `None`.
+    pub breakpilot: BreakpilotConfig,
+}
+
+/// Where to pull the OSCAL control catalog from breakpilot-compliance, and where
+/// to snapshot it for deterministic / offline reuse.
+#[derive(Debug, Clone)]
+pub struct BreakpilotConfig {
+    /// Backend base URL (e.g. `http://backend-compliance:8002`). `None` disables
+    /// the OSCAL controls provider.
+    pub base_url: Option<String>,
+    /// Optional bearer token for the catalog endpoint.
+    pub token: Option<SecretString>,
+    /// Directory for catalog snapshots.
+    pub snapshot_dir: String,
+}
+
+impl Default for BreakpilotConfig {
+    fn default() -> Self {
+        Self {
+            base_url: None,
+            token: None,
+            snapshot_dir: "/data/compliance-scanner/oscal".to_string(),
+        }
+    }
 }
 
 /// Configuration for the ephemeral soft-PLC "provision-and-test" path (#183).