feat(compliance): add content compliance detection across tenant, ops, and clients

Implements the Revision 8/9 compliance design: tenant + ops backends, ops-web
content-safety pages, admin-web editor/publish gate integration, desktop publish
block surfacing, and supporting migrations / shared types / config plumbing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/transport/publish_job_handler.go

@@ -15,7 +15,7 @@ type PublishJobHandler struct {
 
 func NewPublishJobHandler(a *bootstrap.App) *PublishJobHandler {
 	return &PublishJobHandler{
-		svc: app.NewPublishJobService(a.DB, a.RabbitMQ, a.Redis, a.Logger).WithCache(a.Cache),
+		svc: app.NewPublishJobServiceWithConfig(a.DB, a.RabbitMQ, a.Redis, a.Logger, a.ConfigStore).WithCache(a.Cache),
 	}
 }