feat(B-SENS): Sensitive Data Boundary + AI/Data Exposure Policy + AIProvider Compliance

B-SENS: app/core/sensitive_data.py (NEU) — zentrale Sensitive-Field-Verwaltung
- SENSITIVE_FIELDS dict für contact/user/mail_account/system_settings
- is_sensitive(), sanitize_dict(), register_sensitive_fields()
- Integration: errors.py (Log-Redaction), audit.py (Audit-Masking), export_service.py (Export-Filter), embedding.py (Index-Filter)

B-DATA-POL: AI/Data Exposure Policy
- DATA_EXPOSURE_POLICY: pro Entity+Field welche Systeme erlaubt (llm_context/search/embeddings/rag/agent_memory/export)
- filter_for_llm_context/search/embeddings/export/rag/agent_memory()

B-AIPROV-COMP: AIProvider Compliance Metadata
- Migration 0119: 7 neue Spalten an ai_providers (region, hosting_type, dpa_status, retention_policy, training_on_customer_data, transfer_notice, allowed_data_classes)
- llm_client.py: get_provider_compliance() + check_data_class_allowed()

B-PRIV-TEST: 76 Tests in test_sensitive_data.py — alle grün
- Sensitive Fields, Exposure Policy, Provider Compliance, Secrets-always-blocked
- Keine Regression: 39 LLM-Client Tests grün

alembic/versions/0119_ai_provider_compliance_fields.py

@@ -0,0 +1,38 @@
+"""Add compliance metadata columns to ai_providers table (B-AIPROV-COMP).
+
+Adds region, hosting_type, dpa_status, retention_policy,
+training_on_customer_data, transfer_notice, allowed_data_classes
+to support AI provider compliance checks.
+
+Revision ID: 0119
+Revises: 0118
+"""
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import JSONB
+
+revision = "0119"
+down_revision = "0118"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("ai_providers", sa.Column("region", sa.String(20), nullable=False, server_default="unknown"))
+    op.add_column("ai_providers", sa.Column("hosting_type", sa.String(30), nullable=False, server_default="cloud"))
+    op.add_column("ai_providers", sa.Column("dpa_status", sa.String(20), nullable=False, server_default="none"))
+    op.add_column("ai_providers", sa.Column("retention_policy", sa.Text(), nullable=False, server_default=""))
+    op.add_column("ai_providers", sa.Column("training_on_customer_data", sa.Boolean(), nullable=False, server_default=sa.text("false")))
+    op.add_column("ai_providers", sa.Column("transfer_notice", sa.Text(), nullable=False, server_default=""))
+    op.add_column("ai_providers", sa.Column("allowed_data_classes", JSONB, nullable=False, server_default=sa.text("'[]'::jsonb")))
+
+
+def downgrade() -> None:
+    op.drop_column("ai_providers", "allowed_data_classes")
+    op.drop_column("ai_providers", "transfer_notice")
+    op.drop_column("ai_providers", "training_on_customer_data")
+    op.drop_column("ai_providers", "retention_policy")
+    op.drop_column("ai_providers", "dpa_status")
+    op.drop_column("ai_providers", "hosting_type")
+    op.drop_column("ai_providers", "region")