Add document archiving

Documents can be archived and unarchived. Archived documents are
read-only, excluded from the trust center, and moved to a dedicated
Archived tab in the document list.

- Add archived_at timestamp and status (ACTIVE/ARCHIVED) PG enum column
- Rename DocumentStatus → DocumentVersionStatus, introduce DocumentStatus
- Archive/unarchive mutations in GraphQL, MCP, and CLI
- Bulk archive/unarchive mutations with Active/Archived tabs in the list
- ABAC policies: write actions denied on archived docs, unarchive denied
  on active docs
- Remove control/risk mappings and reset trust center visibility on archive
- Exclude archived documents from mapping dialogs and trust center tab

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/trust/document_service.go

@@ -34,8 +34,14 @@ type (
 		svc               *TenantService
 		html2pdfConverter *html2pdf.Converter
 	}
+
+	ErrDocumentArchived struct{}
 )
 
+func (e ErrDocumentArchived) Error() string {
+	return "cannot access an archived document"
+}
+
 func (s *DocumentService) ListForOrganizationId(
 	ctx context.Context,
 	organizationID gid.GID,
@@ -103,6 +109,10 @@ func (s DocumentService) Get(
 				return fmt.Errorf("cannot load document: %w", err)
 			}
 
+			if document.ArchivedAt != nil {
+				return &ErrDocumentArchived{}
+			}
+
 			return nil
 		},
 	)
@@ -138,6 +148,10 @@ func (s *DocumentService) exportPDFData(
 				return fmt.Errorf("cannot load document: %w", err)
 			}
 
+			if document.ArchivedAt != nil {
+				return &ErrDocumentArchived{}
+			}
+
 			if document.TrustCenterVisibility == coredata.TrustCenterVisibilityNone {
 				return fmt.Errorf("document not visible on trust center")
 			}