feat(compliance): add content compliance detection across tenant, ops, and clients

Implements the Revision 8/9 compliance design: tenant + ops backends, ops-web
content-safety pages, admin-web editor/publish gate integration, desktop publish
block surfacing, and supporting migrations / shared types / config plumbing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/compliance/service_test.go

@@ -0,0 +1,36 @@
+package compliance
+
+import (
+	"testing"
+
+	sharedcompliance "github.com/geo-platform/tenant-api/internal/shared/compliance"
+)
+
+func TestDecideMandatoryBlocksAnyHit(t *testing.T) {
+	levels := []string{"block", "high", "medium", "info"}
+	for _, level := range levels {
+		level := level
+		t.Run(level, func(t *testing.T) {
+			got := decide("mandatory", &level, 1)
+			if got != sharedcompliance.GateDecisionBlock {
+				t.Fatalf("decide mandatory %s hit = %s, want %s", level, got, sharedcompliance.GateDecisionBlock)
+			}
+		})
+	}
+}
+
+func TestDecideAdvisoryNeedsAckOnAnyHit(t *testing.T) {
+	level := "info"
+	got := decide("advisory", &level, 1)
+	if got != sharedcompliance.GateDecisionNeedsAck {
+		t.Fatalf("decide advisory hit = %s, want %s", got, sharedcompliance.GateDecisionNeedsAck)
+	}
+}
+
+func TestDecidePassesWithoutHits(t *testing.T) {
+	level := "block"
+	got := decide("mandatory", &level, 0)
+	if got != sharedcompliance.GateDecisionPass {
+		t.Fatalf("decide without hits = %s, want %s", got, sharedcompliance.GateDecisionPass)
+	}
+}