Compliance Controls

Phase 2 scaffold. Full UI ported in subsequent phase per migration framework. Data plane (Prisma + Postgres) is already live; this screen wires up in Phase 3 against the iam.* / compliance.* models.