feat(compliance): add content compliance detection across tenant, ops, and clients

Implements the Revision 8/9 compliance design: tenant + ops backends, ops-web
content-safety pages, admin-web editor/publish gate integration, desktop publish
block surfacing, and supporting migrations / shared types / config plumbing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/cmd/ops-api/main.go

@@ -85,6 +85,7 @@ func main() {
 	adminUserSvc := app.NewAdminUserService(adminUsersRepo, auditSvc, cfg.AdminUsers.DefaultPlanCode).WithLoginGuard(tenantLoginGuard)
 	kolSubscriptionSvc := app.NewKolSubscriptionService(kolSubscriptionsRepo, auditSvc).WithCache(appCache)
 	siteDomainMappingSvc := app.NewSiteDomainMappingService(siteDomainMappingsRepo, auditSvc)
+	complianceSvc := app.NewComplianceService(pool, auditSvc, logger)
 
 	if err := app.SeedDefaultAdmin(ctx, accountsRepo, app.DefaultAdminSeed{
 		Username:    cfg.DefaultAdmin.Username,
@@ -129,6 +130,7 @@ func main() {
 		KolSubs:      kolSubscriptionSvc,
 		Audits:       auditSvc,
 		SiteDomains:  siteDomainMappingSvc,
+		Compliance:   complianceSvc,
 	})
 
 	addr := fmt.Sprintf(":%d", cfg.Server.Port)