Add document archiving

Documents can be archived and unarchived. Archived documents are
read-only, excluded from the trust center, and moved to a dedicated
Archived tab in the document list.

- Add archived_at timestamp and status (ACTIVE/ARCHIVED) PG enum column
- Rename DocumentStatus → DocumentVersionStatus, introduce DocumentStatus
- Archive/unarchive mutations in GraphQL, MCP, and CLI
- Bulk archive/unarchive mutations with Active/Archived tabs in the list
- ABAC policies: write actions denied on archived docs, unarchive denied
  on active docs
- Remove control/risk mappings and reset trust center visibility on archive
- Exclude archived documents from mapping dialogs and trust center tab

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/migrations/20260317T120000Z.sql

@@ -0,0 +1,7 @@
+ALTER TYPE policy_status RENAME TO document_version_status;
+
+CREATE TYPE document_status AS ENUM ('ACTIVE', 'ARCHIVED');
+
+ALTER TABLE documents ADD COLUMN archived_at TIMESTAMP WITH TIME ZONE;
+ALTER TABLE documents ADD COLUMN status document_status NOT NULL DEFAULT 'ACTIVE';
+ALTER TABLE documents ALTER COLUMN status DROP DEFAULT;