Write longer third-party risk assessment vetting notes

Expand buildRiskAssessmentNotes to persist most of the extracted
assessment (classification, per-category risk breakdown, privacy and
data processing practices, AI governance, contractual clauses,
professional standing, and baseline failures) instead of only a short
summary. Fields already stored as structured columns on the third party
(certifications, data locations, document URLs) are omitted to avoid
duplication.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

pkg/vetting/persist_test.go

@@ -26,13 +26,26 @@ func TestBuildRiskAssessmentNotes(t *testing.T) {
 	t.Parallel()
 
 	info := ThirdPartyInfo{
-		OverallRiskRating: "Medium",
-		OverallRiskScore:  62,
-		Recommendation:    "APPROVE_WITH_CONDITIONS",
-		SecurityRiskScore: 45,
-		PrivacyRiskScore:  70,
-		AIRiskScore:       10,
-		InvolvesAI:        true,
+		OverallRiskRating:   "Medium",
+		OverallRiskScore:    62,
+		Recommendation:      "APPROVE_WITH_CONDITIONS",
+		SecurityRiskScore:   45,
+		PrivacyRiskScore:    70,
+		AIRiskScore:         10,
+		ThirdPartyType:      "SAAS",
+		PrivacyRole:         "PROCESSOR",
+		ProcessesPII:        true,
+		CrossBorderTransfer: true,
+		InvolvesAI:          true,
+		AIUseCases:          []string{"content generation", "fraud detection"},
+		DPAStatus:           "AVAILABLE",
+		DSARCapability:      "Self-service portal",
+		DataLocations:       []string{"United States", "EU"},
+		HumanOversight:      "Human review on flagged decisions",
+		PrivacyClauses:      []string{"72-hour breach notification"},
+		AIClauses:           []string{"Customer data not used for training"},
+		Certifications:      []string{"SOC 2 Type II", "ISO 27001"},
+		BaselineFailures:    []string{"No public DPA"},
 		RiskScores: []RiskScore{
 			{Category: "Security", Rating: "Medium", Notes: "Missing SOC 2"},
 		},
@@ -50,6 +63,30 @@ Recommendation: Approve with conditions
 
 Security 45/100 · Privacy 70/100 · AI 10/100
 
+Classification
+· Type: SAAS
+· Privacy role: PROCESSOR
+· Processes PII: yes
+· Cross-border transfers: yes
+· AI involvement: yes (content generation, fraud detection)
+
+Risk breakdown
+· Security — Medium: Missing SOC 2
+
+Privacy & data processing
+· DPA: AVAILABLE
+· DSAR: Self-service portal
+
+AI governance
+· Human oversight: Human review on flagged decisions
+
+Contractual clauses
+· Privacy: 72-hour breach notification
+· AI: Customer data not used for training
+
+Minimum baseline not met
+· No public DPA
+
 Gaps
 · No public DPA
 · Sub-processor list inaccessible`,