Add async third-party vetting

Queue vetting on third_parties with PENDING, PROCESSING,
COMPLETED, and FAILED states. Expose enqueue and status through
GraphQL, MCP, CLI, and n8n, validate vet requests, tune the
worker via config, and poll the detail page while vetting runs.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/vetting/prompts/extraction.txt

@@ -10,4 +10,6 @@ Given a third party assessment markdown report, extract the third party informat
 - Extract only information explicitly present in the report.
 - Use empty strings for fields not mentioned, empty arrays for missing lists, false for missing booleans.
 - Never infer or fabricate; if the report does not state something, leave the field empty.
+- Populate data_locations with countries or regions where data is processed or stored. Prefer ISO 3166-1 alpha-2 codes (US, DE, EU, GLOBAL) when the report states them; otherwise use the country or region names from the report.
+- Include the headquarters country in data_locations when it is stated in the report.
 </important>

pkg/vetting/prompts/orchestrator_base.txt

@@ -26,6 +26,13 @@ If `research_third_party_externally` is available, use it for incidents, regulat
 {procedure}
 </assessment_procedure>
 
+<persistence>
+After completing your analysis and writing the report:
+
+1. Call `save_third_party_info` once with all metadata you discovered (name, description, category, URLs, certifications). Use an empty string for fields you could not find.
+2. For each sub-processor or vendor dependency discovered, call `link_sub_third_party` with the name, description, category, website URL, country, and purpose. If a third party with the same name already exists it is linked without duplication; otherwise a new one is created with the info you provide.
+</persistence>
+
 <important>
 - Only report information actually discovered through the tools — never fabricate URLs, certifications, or findings.
 - Note tool failures and inaccessible pages in the report rather than omitting the section.