feat(K): Phase K EU Compliance — AI Registry, DPIA, Incident Register, Retention Admin, Tests, Doku

- K-REG: GET /api/v1/compliance/ai-registry — lists all agents with ai_use_case_metadata
- K-DPIA: GET /api/v1/compliance/dpia-template — pre-filled DPIA template export
- K-INC: ComplianceIncident model, Migration 0133 (RLS), CRUD routes (admin-only)
- K-RET: GET/PATCH /api/v1/compliance/retention-policies — 5 policies editable
- K-COMP-TEST: 12/12 integration tests pass
- K-DOC: docs/compliance.md — Betriebsdoku
- Frontend: ComplianceTab.tsx in SettingsAI.tsx (new tab)
- 13 files created/modified

alembic/versions/0133_compliance_incidents.py

@@ -0,0 +1,51 @@
+"""compliance_incidents table for AI/privacy/security incident register
+
+Revision ID: 0133
+Revises: 0132
+Create Date: 2026-08-21
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import UUID, JSONB
+
+revision = "0133"
+down_revision = "0132"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "compliance_incidents",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True, server_default=sa.text("gen_random_uuid()")),
+        sa.Column("tenant_id", UUID(as_uuid=True), sa.ForeignKey("tenants.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("incident_type", sa.String(30), nullable=False, server_default=sa.text("'ai'")),
+        sa.Column("title", sa.String(300), nullable=False),
+        sa.Column("description", sa.Text, nullable=False, server_default=sa.text("''")),
+        sa.Column("affected_use_cases", JSONB, nullable=False, server_default=sa.text("'[]'::jsonb")),
+        sa.Column("affected_versions", JSONB, nullable=False, server_default=sa.text("'[]'::jsonb")),
+        sa.Column("provider", sa.String(100), nullable=False, server_default=sa.text("''")),
+        sa.Column("measures_taken", sa.Text, nullable=False, server_default=sa.text("''")),
+        sa.Column("evidence_refs", JSONB, nullable=False, server_default=sa.text("'[]'::jsonb")),
+        sa.Column("status", sa.String(20), nullable=False, server_default=sa.text("'open'")),
+        sa.Column("created_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("resolved_by", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("resolved_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("deleted_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.text("now()")),
+    )
+    op.create_index("ix_compliance_incidents_tenant_status", "compliance_incidents", ["tenant_id", "status"])
+    op.create_index("ix_compliance_incidents_tenant_type", "compliance_incidents", ["tenant_id", "incident_type"])
+
+    # Add retention_config JSONB column to system_settings for compliance retention overrides
+    op.add_column("system_settings", sa.Column("retention_config", JSONB, nullable=True, server_default=sa.text("'{}'::jsonb")))
+
+    # RLS
+    op.execute("ALTER TABLE compliance_incidents ENABLE ROW LEVEL SECURITY;")
+    op.execute("CREATE POLICY compliance_incidents_tenant_isolation ON compliance_incidents USING (tenant_id::text = current_setting('app.current_tenant_id', true));")
+
+
+def downgrade() -> None:
+    op.drop_column("system_settings", "retention_config")
+    op.drop_table("compliance_incidents")