feat(api): onboarding endpoints for unified targets (#131)

REST surface the wizard drives onboarding through:
- GET/POST /api/v1/targets (list paginated / create)
- GET/PATCH/DELETE /api/v1/targets/{id} (fetch / update / delete + cascade
  findings/scans by repo_id)
- POST /api/v1/targets/{id}/artifacts (attach an artifact by reference)
- GET /api/v1/targets/{id}/applicable-scans (scan matrix + pentest support)
- POST /api/v1/targets/{id}/detect (kind-based classification — no ingest;
  deep post-ingest detection is a follow-up)

Follows the existing axum handler/route/DTO conventions (ApiResponse,
PaginationParams, tenant_db, collect_cursor_async, TenantCtx). Multipart artifact
upload and the scan-trigger endpoint (needs the unified pipeline, #133) are
follow-ups.

Also fixes the TestServer db-name prefix (was 37 chars, over the pool's 30-char
cap) which had silently broken every API integration test locally.

3 HTTP integration tests (create/list/applicable-scans, detect->PLC,
add-artifact/delete) — pass against local Mongo.

Closes #131.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

compliance-agent/tests/common/mod.rs

@@ -25,8 +25,9 @@ impl TestServer {
         let mongodb_uri = std::env::var("TEST_MONGODB_URI")
             .unwrap_or_else(|_| "mongodb://root:example@localhost:27017/?authSource=admin".into());
 
-        // Unique database name per test run to avoid collisions
-        let db_name = format!("test_{}", uuid::Uuid::new_v4().simple());
+        // Unique db-name prefix per run. Must fit the pool's 30-char cap
+        // (`<prefix>_<32 hex>` <= 63), so use a 16-hex-char suffix.
+        let db_name = format!("t_{}", &uuid::Uuid::new_v4().simple().to_string()[..16]);
 
         let db_pool = DatabasePool::connect(&mongodb_uri, &db_name)
             .await