Add document archiving

Documents can be archived and unarchived. Archived documents are
read-only, excluded from the trust center, and moved to a dedicated
Archived tab in the document list.

- Add archived_at timestamp and status (ACTIVE/ARCHIVED) PG enum column
- Rename DocumentStatus → DocumentVersionStatus, introduce DocumentStatus
- Archive/unarchive mutations in GraphQL, MCP, and CLI
- Bulk archive/unarchive mutations with Active/Archived tabs in the list
- ABAC policies: write actions denied on archived docs, unarchive denied
  on active docs
- Remove control/risk mappings and reset trust center visibility on archive
- Exclude archived documents from mapping dialogs and trust center tab

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

apps/console/src/components/documents/LinkedDocumentsDialog.tsx

@@ -52,6 +52,7 @@ const documentsFragment = graphql`
       last: $last
       before: $before
       orderBy: $order
+      filter: { status: [ACTIVE] }
     ) @connection(key: "LinkedDocumentsDialogQuery_documents") {
       edges {
         node {