Add document archiving

Documents can be archived and unarchived. Archived documents are
read-only, excluded from the trust center, and moved to a dedicated
Archived tab in the document list.

- Add archived_at timestamp and status (ACTIVE/ARCHIVED) PG enum column
- Rename DocumentStatus → DocumentVersionStatus, introduce DocumentStatus
- Archive/unarchive mutations in GraphQL, MCP, and CLI
- Bulk archive/unarchive mutations with Active/Archived tabs in the list
- ABAC policies: write actions denied on archived docs, unarchive denied
  on active docs
- Remove control/risk mappings and reset trust center visibility on archive
- Exclude archived documents from mapping dialogs and trust center tab

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -799,7 +799,7 @@ func (r *Resolver) AddFindingTool(ctx context.Context, req *mcp.CallToolRequest,
 			Kind:               input.Kind,
 			Description:        input.Description,
 			Source:             input.Source,
-			IdentifiedOn:     input.IdentifiedOn,
+			IdentifiedOn:       input.IdentifiedOn,
 			RootCause:          input.RootCause,
 			CorrectiveAction:   input.CorrectiveAction,
 			OwnerID:            input.OwnerID,
@@ -830,7 +830,7 @@ func (r *Resolver) UpdateFindingTool(ctx context.Context, req *mcp.CallToolReque
 			ID:                 input.ID,
 			Description:        UnwrapOmittable(input.Description),
 			Source:             UnwrapOmittable(input.Source),
-			IdentifiedOn:     UnwrapOmittable(input.IdentifiedOn),
+			IdentifiedOn:       UnwrapOmittable(input.IdentifiedOn),
 			RootCause:          UnwrapOmittable(input.RootCause),
 			CorrectiveAction:   UnwrapOmittable(input.CorrectiveAction),
 			OwnerID:            input.OwnerID,
@@ -3201,3 +3201,43 @@ func (r *Resolver) ListFindingAuditsTool(ctx context.Context, req *mcp.CallToolR
 
 	return nil, types.NewListFindingAuditsOutput(auditPage), nil
 }
+
+func (r *Resolver) ArchiveDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ArchiveDocumentInput) (*mcp.CallToolResult, types.ArchiveDocumentOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionDocumentArchive)
+
+	svc := r.ProboService(ctx, input.ID)
+
+	document, err := svc.Documents.Archive(ctx, input.ID)
+	if err != nil {
+		return nil, types.ArchiveDocumentOutput{}, fmt.Errorf("cannot archive document: %w", err)
+	}
+
+	approverPage, err := svc.Documents.ListApprovers(ctx, input.ID, allApproversCursor())
+	if err != nil {
+		return nil, types.ArchiveDocumentOutput{}, fmt.Errorf("cannot list document approvers: %w", err)
+	}
+
+	return nil, types.ArchiveDocumentOutput{
+		Document: types.NewDocument(document, profileIDs(approverPage)),
+	}, nil
+}
+
+func (r *Resolver) UnarchiveDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnarchiveDocumentInput) (*mcp.CallToolResult, types.UnarchiveDocumentOutput, error) {
+	r.MustAuthorize(ctx, input.ID, probo.ActionDocumentUnarchive)
+
+	svc := r.ProboService(ctx, input.ID)
+
+	document, err := svc.Documents.Unarchive(ctx, input.ID)
+	if err != nil {
+		return nil, types.UnarchiveDocumentOutput{}, fmt.Errorf("cannot unarchive document: %w", err)
+	}
+
+	approverPage, err := svc.Documents.ListApprovers(ctx, input.ID, allApproversCursor())
+	if err != nil {
+		return nil, types.UnarchiveDocumentOutput{}, fmt.Errorf("cannot list document approvers: %w", err)
+	}
+
+	return nil, types.UnarchiveDocumentOutput{
+		Document: types.NewDocument(document, profileIDs(approverPage)),
+	}, nil
+}