feat(compliance): add content compliance detection across tenant, ops, and clients

Implements the Revision 8/9 compliance design: tenant + ops backends, ops-web
content-safety pages, admin-web editor/publish gate integration, desktop publish
block surfacing, and supporting migrations / shared types / config plumbing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/cmd/ops-api/main.go

@@ -85,6 +85,7 @@ func main() {
 	adminUserSvc := app.NewAdminUserService(adminUsersRepo, auditSvc, cfg.AdminUsers.DefaultPlanCode).WithLoginGuard(tenantLoginGuard)
 	kolSubscriptionSvc := app.NewKolSubscriptionService(kolSubscriptionsRepo, auditSvc).WithCache(appCache)
 	siteDomainMappingSvc := app.NewSiteDomainMappingService(siteDomainMappingsRepo, auditSvc)
+	complianceSvc := app.NewComplianceService(pool, auditSvc, logger)
 
 	if err := app.SeedDefaultAdmin(ctx, accountsRepo, app.DefaultAdminSeed{
 		Username:    cfg.DefaultAdmin.Username,
@@ -129,6 +130,7 @@ func main() {
 		KolSubs:      kolSubscriptionSvc,
 		Audits:       auditSvc,
 		SiteDomains:  siteDomainMappingSvc,
+		Compliance:   complianceSvc,
 	})
 
 	addr := fmt.Sprintf(":%d", cfg.Server.Port)

server/cmd/worker-generate/main.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/geo-platform/tenant-api/internal/bootstrap"
 	tenantapp "github.com/geo-platform/tenant-api/internal/tenant/app"
+	tenantcompliance "github.com/geo-platform/tenant-api/internal/tenant/compliance"
 	"github.com/geo-platform/tenant-api/internal/tenant/repository"
 	generateworker "github.com/geo-platform/tenant-api/internal/worker/generate"
 )
@@ -66,11 +67,12 @@ func main() {
 		app.Config().LLM.MaxOutputTokens,
 	).WithCache(app.Cache).WithLogger(app.Logger).WithConfigProvider(generationProvider)
 
-	publishJobSvc := tenantapp.NewPublishJobService(
+	publishJobSvc := tenantapp.NewPublishJobServiceWithConfig(
 		app.DB,
 		app.RabbitMQ,
 		app.Redis,
 		app.Logger,
+		app.ConfigStore,
 	).WithCache(app.Cache)
 	promptRuleSvc.WithPublishJobService(publishJobSvc)
 
@@ -117,6 +119,13 @@ func main() {
 		app.Config().Generation.ArticleTimeout,
 	).WithConfigProvider(app.ConfigStore).Start(ctx)
 
+	generateworker.NewComplianceReviewWorker(
+		app.RabbitMQ,
+		tenantcompliance.NewService(app.DB, app.ConfigStore, app.Logger).WithRabbitMQ(app.RabbitMQ).WithLLM(app.LLM),
+		app.Logger,
+		app.Config().Compliance,
+	).WithConfigProvider(app.ConfigStore).Start(ctx)
+
 	app.Logger.Info("worker-generate started")
 
 	quit := make(chan os.Signal, 1)