Add document archiving

Documents can be archived and unarchived. Archived documents are
read-only, excluded from the trust center, and moved to a dedicated
Archived tab in the document list.

- Add archived_at timestamp and status (ACTIVE/ARCHIVED) PG enum column
- Rename DocumentStatus → DocumentVersionStatus, introduce DocumentStatus
- Archive/unarchive mutations in GraphQL, MCP, and CLI
- Bulk archive/unarchive mutations with Active/Archived tabs in the list
- ABAC policies: write actions denied on archived docs, unarchive denied
  on active docs
- Remove control/risk mappings and reset trust center visibility on archive
- Exclude archived documents from mapping dialogs and trust center tab

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/document_status.go

@@ -19,56 +19,43 @@ import (
 	"fmt"
 )
 
-type (
-	DocumentStatus uint8
-)
+type DocumentStatus string
 
 const (
-	DocumentStatusDraft DocumentStatus = iota
-	DocumentStatusPublished
+	DocumentStatusActive   DocumentStatus = "ACTIVE"
+	DocumentStatusArchived DocumentStatus = "ARCHIVED"
 )
 
-func (ps DocumentStatus) MarshalText() ([]byte, error) {
-	return []byte(ps.String()), nil
+func (s DocumentStatus) IsValid() bool {
+	switch s {
+	case DocumentStatusActive, DocumentStatusArchived:
+		return true
+	}
+	return false
 }
 
-func (ps *DocumentStatus) UnmarshalText(data []byte) error {
-	val := string(data)
+func (s DocumentStatus) String() string { return string(s) }
 
-	switch val {
-	case DocumentStatusDraft.String():
-		*ps = DocumentStatusDraft
-	case DocumentStatusPublished.String():
-		*ps = DocumentStatusPublished
-	default:
-		return fmt.Errorf("invalid DocumentStatus value: %q", val)
+func (s *DocumentStatus) UnmarshalText(text []byte) error {
+	*s = DocumentStatus(text)
+	if !s.IsValid() {
+		return fmt.Errorf("%s is not a valid DocumentStatus", string(text))
 	}
-
 	return nil
 }
 
-func (ps DocumentStatus) String() string {
-	var val string
-
-	switch ps {
-	case DocumentStatusDraft:
-		val = "DRAFT"
-	case DocumentStatusPublished:
-		val = "PUBLISHED"
-	}
-
-	return val
+func (s DocumentStatus) MarshalText() ([]byte, error) {
+	return []byte(s.String()), nil
 }
 
-func (ps *DocumentStatus) Scan(value any) error {
+func (s *DocumentStatus) Scan(value any) error {
 	val, ok := value.(string)
 	if !ok {
 		return fmt.Errorf("invalid scan source for DocumentStatus, expected string got %T", value)
 	}
-
-	return ps.UnmarshalText([]byte(val))
+	return s.UnmarshalText([]byte(val))
 }
 
-func (ps DocumentStatus) Value() (driver.Value, error) {
-	return ps.String(), nil
+func (s DocumentStatus) Value() (driver.Value, error) {
+	return s.String(), nil
 }