feat(compliance): add content compliance detection across tenant, ops, and clients

Implements the Revision 8/9 compliance design: tenant + ops backends, ops-web
content-safety pages, admin-web editor/publish gate integration, desktop publish
block surfacing, and supporting migrations / shared types / config plumbing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/cmd/worker-generate/main.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/geo-platform/tenant-api/internal/bootstrap"
 	tenantapp "github.com/geo-platform/tenant-api/internal/tenant/app"
+	tenantcompliance "github.com/geo-platform/tenant-api/internal/tenant/compliance"
 	"github.com/geo-platform/tenant-api/internal/tenant/repository"
 	generateworker "github.com/geo-platform/tenant-api/internal/worker/generate"
 )
@@ -66,11 +67,12 @@ func main() {
 		app.Config().LLM.MaxOutputTokens,
 	).WithCache(app.Cache).WithLogger(app.Logger).WithConfigProvider(generationProvider)
 
-	publishJobSvc := tenantapp.NewPublishJobService(
+	publishJobSvc := tenantapp.NewPublishJobServiceWithConfig(
 		app.DB,
 		app.RabbitMQ,
 		app.Redis,
 		app.Logger,
+		app.ConfigStore,
 	).WithCache(app.Cache)
 	promptRuleSvc.WithPublishJobService(publishJobSvc)
 
@@ -117,6 +119,13 @@ func main() {
 		app.Config().Generation.ArticleTimeout,
 	).WithConfigProvider(app.ConfigStore).Start(ctx)
 
+	generateworker.NewComplianceReviewWorker(
+		app.RabbitMQ,
+		tenantcompliance.NewService(app.DB, app.ConfigStore, app.Logger).WithRabbitMQ(app.RabbitMQ).WithLLM(app.LLM),
+		app.Logger,
+		app.Config().Compliance,
+	).WithConfigProvider(app.ConfigStore).Start(ctx)
+
 	app.Logger.Info("worker-generate started")
 
 	quit := make(chan os.Signal, 1)