Add risk publish to document system

Replace the old snapshot-based system for risks with the publish
document system, mirroring the prior vendor / processing activity / DPIA
/ TIA migration. Includes the GraphQL mutation, MCP tool, CLI command,
n8n operation, frontend publish dialog, e2e tests, and a prosemirror
register template covering name, description, category, treatment,
owner, inherent and residual scoring, and notes.

The risk register lives as a generated DocumentTypeRegister document on
the organization, reused across publishes (the major version bumps on
every republish). Approvers can be passed in to create a draft pending
approval; otherwise the version is published immediately. The frontend
Risks page exposes a Publish button and a Document link button when the
document exists, and pre-fills the previous default approvers.

Risks was the last remaining snapshot type, so this commit also removes
the entire snapshot system: drop snapshotId from the Risk GraphQL type
and RiskFilter; remove RiskSnapshotter, Risks.Snapshot,
InsertRiskSnapshots, and the SnapshotID/SourceID fields on Risk; delete
Snapshot, ControlSnapshot, SnapshotsType, SnapshotOrderField,
Snapshottable, the SnapshotService, the Snapshot console resolvers and
GraphQL schema, the Snapshot MCP types and operations
(list/get/take/listControlSnapshots), the snapshot CLI (prb snapshot),
the snapshot frontend pages, routes, banner, LinkedSnapshotsCard,
SnapshotGraph, snapshot helpers, and the snapshot n8n resource and
control link/unlink snapshot operations. The snapshot_id columns remain
in the database but are now filtered out with snapshot_id IS NULL.

Add Get/Upsert/Clear GeneratedDocumentID methods on Risk backed by a new
risks_document_id column on generated_documents, matching the
ProcessingActivity/Finding/Vendor pattern. The migration command
migrate-risk-snapshots-to-documents uses raw SQL queries instead of the
Go snapshot types, since those are gone.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/console/v1/graphql/control.graphql

@@ -141,14 +141,6 @@ type Control implements Node {
         orderBy: ObligationOrder
     ): ObligationConnection! @goField(forceResolver: true)
 
-    snapshots(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: SnapshotOrder
-    ): SnapshotConnection! @goField(forceResolver: true)
-
     createdAt: Datetime!
     updatedAt: Datetime!
 
@@ -265,12 +257,6 @@ extend type Mutation {
     deleteControlObligationMapping(
         input: DeleteControlObligationMappingInput!
     ): DeleteControlObligationMappingPayload!
-    createControlSnapshotMapping(
-        input: CreateControlSnapshotMappingInput!
-    ): CreateControlSnapshotMappingPayload!
-    deleteControlSnapshotMapping(
-        input: DeleteControlSnapshotMappingInput!
-    ): DeleteControlSnapshotMappingPayload!
     createStatementOfApplicability(
         input: CreateStatementOfApplicabilityInput!
     ): CreateStatementOfApplicabilityPayload!
@@ -366,16 +352,6 @@ input DeleteControlObligationMappingInput {
     obligationId: ID!
 }
 
-input CreateControlSnapshotMappingInput {
-    controlId: ID!
-    snapshotId: ID!
-}
-
-input DeleteControlSnapshotMappingInput {
-    controlId: ID!
-    snapshotId: ID!
-}
-
 input CreateStatementOfApplicabilityInput {
     organizationId: ID!
     name: String!
@@ -465,16 +441,6 @@ type DeleteControlObligationMappingPayload {
     deletedObligationId: ID!
 }
 
-type CreateControlSnapshotMappingPayload {
-    controlEdge: ControlEdge!
-    snapshotEdge: SnapshotEdge!
-}
-
-type DeleteControlSnapshotMappingPayload {
-    deletedControlId: ID!
-    deletedSnapshotId: ID!
-}
-
 type CreateStatementOfApplicabilityPayload {
     statementOfApplicabilityEdge: StatementOfApplicabilityEdge!
 }

pkg/server/api/console/v1/graphql/organization.graphql

@@ -286,16 +286,10 @@ type Organization implements Node {
         last: Int
         before: CursorKey
         orderBy: RiskOrder
-        filter: RiskFilter = { snapshotId: null }
+        filter: RiskFilter
     ): RiskConnection! @goField(forceResolver: true)
 
-    snapshots(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: SnapshotOrder
-    ): SnapshotConnection! @goField(forceResolver: true)
+    risksDocument: Document @goField(forceResolver: true)
 
     tasks(
         first: Int

pkg/server/api/console/v1/graphql/risk.graphql

@@ -53,12 +53,10 @@ input RiskOrder
 
 input RiskFilter {
     query: String
-    snapshotId: ID
 }
 
 type Risk implements Node {
     id: ID!
-    snapshotId: ID
     name: String!
     description: String
     category: String!
@@ -151,6 +149,19 @@ extend type Mutation {
     deleteRiskObligationMapping(
         input: DeleteRiskObligationMappingInput!
     ): DeleteRiskObligationMappingPayload!
+    publishRiskList(
+        input: PublishRiskListInput!
+    ): PublishRiskListPayload!
+}
+
+input PublishRiskListInput {
+    organizationId: ID!
+    approverIds: [ID!]
+}
+
+type PublishRiskListPayload {
+    documentEdge: DocumentEdge!
+    documentVersionEdge: DocumentVersionEdge!
 }
 
 input CreateRiskInput {

pkg/server/api/console/v1/graphql/snapshot.graphql

@@ -1,83 +0,0 @@
-enum SnapshotsType
-    @goModel(model: "go.probo.inc/probo/pkg/coredata.SnapshotsType") {
-    RISKS @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeRisks")
-}
-
-enum SnapshotOrderField
-    @goModel(model: "go.probo.inc/probo/pkg/coredata.SnapshotOrderField") {
-    CREATED_AT
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldCreatedAt"
-        )
-    NAME
-        @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldName")
-    TYPE
-        @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotOrderFieldType")
-}
-
-input SnapshotOrder
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.SnapshotOrderBy"
-    ) {
-    direction: OrderDirection!
-    field: SnapshotOrderField!
-}
-
-type Snapshot implements Node {
-    id: ID!
-    organization: Organization! @goField(forceResolver: true)
-    name: String!
-    description: String
-    type: SnapshotsType!
-
-    controls(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: ControlOrder
-        filter: ControlFilter
-    ): ControlConnection! @goField(forceResolver: true)
-
-    createdAt: Datetime!
-
-    permission(action: String!): Boolean! @goField(forceResolver: true)
-}
-
-type SnapshotConnection
-    @goModel(
-        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.SnapshotConnection"
-    ) {
-    totalCount: Int! @goField(forceResolver: true)
-    edges: [SnapshotEdge!]!
-    pageInfo: PageInfo!
-}
-
-type SnapshotEdge {
-    cursor: CursorKey!
-    node: Snapshot!
-}
-
-extend type Mutation {
-    createSnapshot(input: CreateSnapshotInput!): CreateSnapshotPayload!
-    deleteSnapshot(input: DeleteSnapshotInput!): DeleteSnapshotPayload!
-}
-
-input CreateSnapshotInput {
-    organizationId: ID!
-    name: String!
-    description: String
-    type: SnapshotsType!
-}
-
-input DeleteSnapshotInput {
-    snapshotId: ID!
-}
-
-type CreateSnapshotPayload {
-    snapshotEdge: SnapshotEdge!
-}
-
-type DeleteSnapshotPayload {
-    deletedSnapshotId: ID!
-}