Add documents page to the compliance portal

Build the Trust Center documents page: a unified list of published
documents, uploaded files, and audit reports, grouped into category
sections. An All/Public/Private tab bar filters the list by trust
center visibility.

Expose that filter over the trust v1 API by adding a
TrustCenterVisibility enum and a shared TrustCenterVisibilityFilter
input, wiring it through the documents, audits, and trustCenterFiles
connections down to the existing coredata SQL filters. "All" keeps the
default public+private slice; the other tabs pin a single visibility.

Access controls are display-only for now (auth is handled separately):
authorized or public entries open their exported PDF via the export
mutations, requested entries show a pending state, and everything else
shows an inert Get Access affordance.

Add the v2 Tabs and Toaster kit components (Base UI headless) needed by
the page and mount a toast provider at the app root for mutation
feedback.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/trust/audit_service.go

@@ -88,14 +88,17 @@ func (s AuditService) ListForOrganizationId(
 	scope coredata.Scoper,
 	organizationID gid.GID,
 	cursor *page.Cursor[coredata.AuditOrderField],
+	filter *coredata.AuditFilter,
 ) (*page.Page[*coredata.Audit, coredata.AuditOrderField], error) {
 	var audits coredata.Audits
 
+	if filter == nil {
+		filter = coredata.NewAuditTrustCenterFilter()
+	}
+
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			filter := coredata.NewAuditTrustCenterFilter()
-
 			err := audits.LoadByOrganizationID(ctx, conn, scope, organizationID, cursor, filter)
 			if err != nil {
 				return fmt.Errorf("cannot load audits: %w", err)

pkg/trust/compliance_page_service.go

@@ -271,7 +271,7 @@ func (s *Service) fetchDocumentIDs(ctx context.Context, scope coredata.Scoper, o
 			},
 		)
 
-		result, err := s.Documents.ListForOrganizationId(ctx, scope, orgID, cursor)
+		result, err := s.Documents.ListForOrganizationId(ctx, scope, orgID, cursor, nil)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list documents: %w", err)
 		}
@@ -345,7 +345,7 @@ func (s *Service) fetchDocumentIDs(ctx context.Context, scope coredata.Scoper, o
 			},
 		)
 
-		result, err := s.Audits.ListForOrganizationId(ctx, scope, orgID, cursor)
+		result, err := s.Audits.ListForOrganizationId(ctx, scope, orgID, cursor, nil)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list audits: %w", err)
 		}
@@ -454,7 +454,7 @@ func (s *Service) fetchDocuments(ctx context.Context, scope coredata.Scoper, org
 			},
 		)
 
-		result, err := s.Documents.ListForOrganizationId(ctx, scope, orgID, cursor)
+		result, err := s.Documents.ListForOrganizationId(ctx, scope, orgID, cursor, nil)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list documents: %w", err)
 		}
@@ -500,7 +500,7 @@ func (s *Service) fetchAudits(ctx context.Context, scope coredata.Scoper, orgID
 			},
 		)
 
-		result, err := s.Audits.ListForOrganizationId(ctx, scope, orgID, cursor)
+		result, err := s.Audits.ListForOrganizationId(ctx, scope, orgID, cursor, nil)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list audits: %w", err)
 		}

pkg/trust/document_service.go

@@ -55,14 +55,17 @@ func (s *DocumentService) ListForOrganizationId(
 	scope coredata.Scoper,
 	organizationID gid.GID,
 	cursor *page.Cursor[coredata.DocumentOrderField],
+	filter *coredata.DocumentFilter,
 ) (*page.Page[*coredata.Document, coredata.DocumentOrderField], error) {
 	var documents coredata.Documents
 
+	if filter == nil {
+		filter = coredata.NewDocumentTrustCenterFilter()
+	}
+
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			filter := coredata.NewDocumentTrustCenterFilter()
-
 			if err := documents.LoadPublishedByOrganizationID(ctx, conn, scope, organizationID, cursor, filter); err != nil {
 				return fmt.Errorf("cannot load published documents: %w", err)
 			}