feat(compliance): add content compliance detection across tenant, ops, and clients

Implements the Revision 8/9 compliance design: tenant + ops backends, ops-web
content-safety pages, admin-web editor/publish gate integration, desktop publish
block surfacing, and supporting migrations / shared types / config plumbing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

task_plan.md

@@ -4,7 +4,7 @@
 Continue the desktop AI monitoring implementation by first adding a client-side local scheduler with durable queueing and adaptive execution policy, then adding a reusable hidden Playwright CDP execution layer that attaches to Electron Chromium and reuses existing account partitions.
 
 ## Current Phase
-Phase 40
+Phase 41
 
 ## Phases
 ### Phase 1: Progress Verification
@@ -284,6 +284,25 @@ Phase 40
 - [x] Validate rendered deployment/config files
 - **Status:** complete
 
+### Phase 41: Compliance Backend Foundation
+- [x] Add tenant and ops compliance migrations from the Revision 8 design
+- [x] Add shared compliance config, DTOs, and TypeScript contracts
+- [x] Implement tenant compliance repository, deterministic matcher, policy resolver, manual review resolver, and service facade
+- [x] Register tenant compliance APIs and wire PublishJobService through GateForPublish
+- **Status:** complete
+
+### Phase 42: Compliance Ops & Admin UI
+- [x] Implement ops compliance dictionary, policy, record, stats, and manual-review APIs
+- [x] Add ops-web content safety navigation and pages for policy, dictionaries, records, stats, and manual reviews
+- [x] Add admin-web compliance API client, editor check button, publish modal gate/ack/manual-review flow, and blocked publish state display
+- **Status:** complete
+
+### Phase 43: Compliance Verification
+- [x] Run targeted Go tests and compile checks for tenant/ops compliance paths
+- [x] Run admin-web and ops-web typecheck/build checks
+- [x] Update findings/progress and summarize completed functions plus any deferred risk
+- **Status:** complete
+
 ## Key Questions
 1. How should the desktop client defer and locally optimize monitor-task execution without violating one-task-per-platform serialism?
 2. What is the smallest durable local cache that allows same-day resume while safely dropping stale next-day monitor tasks?