Add risk publish to document system

Replace the old snapshot-based system for risks with the publish
document system, mirroring the prior vendor / processing activity / DPIA
/ TIA migration. Includes the GraphQL mutation, MCP tool, CLI command,
n8n operation, frontend publish dialog, e2e tests, and a prosemirror
register template covering name, description, category, treatment,
owner, inherent and residual scoring, and notes.

The risk register lives as a generated DocumentTypeRegister document on
the organization, reused across publishes (the major version bumps on
every republish). Approvers can be passed in to create a draft pending
approval; otherwise the version is published immediately. The frontend
Risks page exposes a Publish button and a Document link button when the
document exists, and pre-fills the previous default approvers.

Risks was the last remaining snapshot type, so this commit also removes
the entire snapshot system: drop snapshotId from the Risk GraphQL type
and RiskFilter; remove RiskSnapshotter, Risks.Snapshot,
InsertRiskSnapshots, and the SnapshotID/SourceID fields on Risk; delete
Snapshot, ControlSnapshot, SnapshotsType, SnapshotOrderField,
Snapshottable, the SnapshotService, the Snapshot console resolvers and
GraphQL schema, the Snapshot MCP types and operations
(list/get/take/listControlSnapshots), the snapshot CLI (prb snapshot),
the snapshot frontend pages, routes, banner, LinkedSnapshotsCard,
SnapshotGraph, snapshot helpers, and the snapshot n8n resource and
control link/unlink snapshot operations. The snapshot_id columns remain
in the database but are now filtered out with snapshot_id IS NULL.

Add Get/Upsert/Clear GeneratedDocumentID methods on Risk backed by a new
risks_document_id column on generated_documents, matching the
ProcessingActivity/Finding/Vendor pattern. The migration command
migrate-risk-snapshots-to-documents uses raw SQL queries instead of the
Go snapshot types, since those are gone.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/control.go

@@ -970,77 +970,6 @@ WHERE %s
 	return nil
 }
 
-func (c *Controls) LoadBySnapshotID(
-	ctx context.Context,
-	conn pg.Querier,
-	scope Scoper,
-	snapshotID gid.GID,
-	cursor *page.Cursor[ControlOrderField],
-	filter *ControlFilter,
-) error {
-	q := `
-WITH ctrl AS (
-	SELECT
-		c.id,
-		c.section_title,
-		c.framework_id,
-		c.organization_id,
-		c.tenant_id,
-		c.name,
-		c.description,
-		c.best_practice,
-		c.not_implemented_justification,
-		c.maturity_level,
-		c.created_at,
-		c.updated_at,
-		c.search_vector
-	FROM
-		controls c
-	INNER JOIN
-		controls_snapshots cs ON c.id = cs.control_id
-	WHERE
-		cs.snapshot_id = @snapshot_id
-)
-SELECT
-	id,
-	section_title,
-	framework_id,
-	organization_id,
-	name,
-	description,
-	best_practice,
-	not_implemented_justification,
-	maturity_level,
-	created_at,
-	updated_at
-FROM
-	ctrl
-WHERE %s
-	AND %s
-	AND %s
-`
-	q = fmt.Sprintf(q, scope.SQLFragment(), filter.SQLFragment(), cursor.SQLFragment())
-
-	args := pgx.NamedArgs{"snapshot_id": snapshotID}
-	maps.Copy(args, scope.SQLArguments())
-	maps.Copy(args, filter.SQLArguments())
-	maps.Copy(args, cursor.SQLArguments())
-
-	rows, err := conn.Query(ctx, q, args)
-	if err != nil {
-		return fmt.Errorf("cannot query controls: %w", err)
-	}
-
-	controls, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[Control])
-	if err != nil {
-		return fmt.Errorf("cannot collect controls: %w", err)
-	}
-
-	*c = controls
-
-	return nil
-}
-
 func (c *Controls) CountByStatementOfApplicabilityID(
 	ctx context.Context,
 	conn pg.Querier,