feat(B-SENS): Sensitive Data Boundary + AI/Data Exposure Policy + AIProvider Compliance

B-SENS: app/core/sensitive_data.py (NEU) — zentrale Sensitive-Field-Verwaltung
- SENSITIVE_FIELDS dict für contact/user/mail_account/system_settings
- is_sensitive(), sanitize_dict(), register_sensitive_fields()
- Integration: errors.py (Log-Redaction), audit.py (Audit-Masking), export_service.py (Export-Filter), embedding.py (Index-Filter)

B-DATA-POL: AI/Data Exposure Policy
- DATA_EXPOSURE_POLICY: pro Entity+Field welche Systeme erlaubt (llm_context/search/embeddings/rag/agent_memory/export)
- filter_for_llm_context/search/embeddings/export/rag/agent_memory()

B-AIPROV-COMP: AIProvider Compliance Metadata
- Migration 0119: 7 neue Spalten an ai_providers (region, hosting_type, dpa_status, retention_policy, training_on_customer_data, transfer_notice, allowed_data_classes)
- llm_client.py: get_provider_compliance() + check_data_class_allowed()

B-PRIV-TEST: 76 Tests in test_sensitive_data.py — alle grün
- Sensitive Fields, Exposure Policy, Provider Compliance, Secrets-always-blocked
- Keine Regression: 39 LLM-Client Tests grün

app/ai/llm_client.py

@@ -131,6 +131,60 @@ async def get_api_credentials(
     return (env_key if env_key else None), None, None
 
 
+async def get_provider_compliance(
+    db: AsyncSession | None,
+    tenant_id: uuid.UUID | None,
+) -> dict[str, Any] | None:
+    """Get compliance metadata for the active AI provider.
+
+    Returns a dict with keys: ``region``, ``hosting_type``, ``dpa_status``,
+    ``retention_policy``, ``training_on_customer_data``, ``transfer_notice``,
+    ``allowed_data_classes``.
+
+    Returns ``None`` if no DB provider is configured (env-based fallback).
+    """
+    if not (db and tenant_id):
+        return None
+    try:
+        from app.plugins.builtins.ai_assistant.contracts import get_default_provider
+
+        provider = await get_default_provider(db, tenant_id)
+        if provider is None:
+            return None
+        return {
+            "region": getattr(provider, "region", "unknown"),
+            "hosting_type": getattr(provider, "hosting_type", "cloud"),
+            "dpa_status": getattr(provider, "dpa_status", "none"),
+            "retention_policy": getattr(provider, "retention_policy", ""),
+            "training_on_customer_data": getattr(provider, "training_on_customer_data", False),
+            "transfer_notice": getattr(provider, "transfer_notice", ""),
+            "allowed_data_classes": getattr(provider, "allowed_data_classes", []),
+        }
+    except Exception:
+        logger.debug("Failed to get provider compliance metadata")
+        return None
+
+
+def check_data_class_allowed(
+    compliance: dict[str, Any] | None,
+    data_class: str,
+) -> bool:
+    """Check whether the configured provider may process *data_class*.
+
+    Uses :func:`app.core.sensitive_data.check_provider_compliance`.
+    Returns ``True`` if compliance metadata is unavailable (fail-open for
+    backward compatibility and mock mode).
+    """
+    from app.core.sensitive_data import check_provider_compliance
+
+    if compliance is None:
+        return True
+    return check_provider_compliance(
+        compliance.get("allowed_data_classes"),
+        data_class,
+    )
+
+
 def build_model(model: str, provider_type: str | None) -> str:
     """Build LiteLLM model string with provider prefix.