feat(compliance): add content compliance detection across tenant, ops, and clients

Implements the Revision 8/9 compliance design: tenant + ops backends, ops-web
content-safety pages, admin-web editor/publish gate integration, desktop publish
block surfacing, and supporting migrations / shared types / config plumbing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/article_service.go

@@ -146,6 +146,7 @@ type ArticleDetailResponse struct {
 	ID                     int64                  `json:"id"`
 	SourceType             string                 `json:"source_type"`
 	TemplateID             *int64                 `json:"template_id"`
+	CurrentVersionID       *int64                 `json:"current_version_id"`
 	TemplateName           *string                `json:"template_name"`
 	GenerationMode         *string                `json:"generation_mode"`
 	AutoPublishPlatforms   []string               `json:"auto_publish_platforms"`
@@ -401,6 +402,7 @@ func (s *ArticleService) loadArticleDetail(ctx context.Context, tenantID, articl
 
 	item.SourceType = dbSourceType
 	if currentVersionID != nil {
+		item.CurrentVersionID = currentVersionID
 		content, err := repository.LoadArticleVersionContent(ctx, s.pool, item.ID, *currentVersionID)
 		if err != nil {
 			return nil, false, response.ErrInternal(50011, "article_version_reconstruct_failed", "failed to reconstruct article version")