Basis: Certvia dev@a48c5fb als Fundament für Craftvia

Unveränderter Stand von certvia/dev (a48c5fb) plus Craftvia-Spezifikation
und Brandbook unter docs/craftvia/. ISMS-Module werden im Folgecommit entfernt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

prisma/migrations/20260821100000_soa_entries/migration.sql

@@ -0,0 +1,37 @@
+-- CreateTable
+CREATE TABLE "soa_entries" (
+    "id" TEXT NOT NULL,
+    "tenant_id" TEXT NOT NULL,
+    "framework" "Framework" NOT NULL,
+    "control" TEXT NOT NULL,
+    "title" TEXT,
+    "applicable" BOOLEAN NOT NULL DEFAULT true,
+    "justification" TEXT NOT NULL DEFAULT '',
+    "source" TEXT,
+    "implementation_status" TEXT NOT NULL DEFAULT 'geplant',
+    "owner_id" TEXT,
+    "policy_code" TEXT,
+    "evidence_id" TEXT,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "soa_entries_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "soa_entries_tenant_id_idx" ON "soa_entries"("tenant_id");
+
+-- CreateIndex
+CREATE INDEX "soa_entries_tenant_id_framework_idx" ON "soa_entries"("tenant_id", "framework");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "soa_entries_tenant_id_framework_control_key" ON "soa_entries"("tenant_id", "framework", "control");
+
+
+-- AP3 — Row Level Security auf der SoA-Tabelle (F-04: FORCE + WITH CHECK).
+ALTER TABLE "soa_entries" ENABLE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON "soa_entries";
+CREATE POLICY tenant_isolation ON "soa_entries"
+  USING ("tenant_id" = current_setting('app.tenant_id', true))
+  WITH CHECK ("tenant_id" = current_setting('app.tenant_id', true));
+ALTER TABLE "soa_entries" FORCE ROW LEVEL SECURITY;