Add finding and obligation publish to document system

Replace the old snapshot-based approach with the new publish document
system for findings and obligations. Includes GraphQL mutations, MCP
tools, CLI commands, e2e tests, frontend publish dialogs, and
snapshot-to-document migration tools.

Remove snapshot mode entirely from findings and obligations: drop
snapshotId from GraphQL schemas, filters, resolvers, MCP spec, frontend
routes, pages, and helpers. The snapshot_id column remains in the
database but is now filtered out with snapshot_id IS NULL.

Remove auditor's ability to publish SoA.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

apps/console/src/hooks/graph/ObligationGraph.ts

@@ -25,11 +25,18 @@ import { useMutationWithToasts } from "../useMutationWithToasts";
 export const ObligationsConnectionKey = "ObligationsPage_obligations";
 
 export const obligationsQuery = graphql`
-  query ObligationGraphListQuery($organizationId: ID!, $snapshotId: ID) {
+  query ObligationGraphListQuery($organizationId: ID!) {
     node(id: $organizationId) {
       ... on Organization {
         canCreateObligation: permission(action: "core:obligation:create")
-        ...ObligationsPageFragment @arguments(snapshotId: $snapshotId)
+        canPublishObligations: permission(action: "core:obligation:publish")
+        obligationsDocument {
+          id
+          defaultApprovers {
+            id
+          }
+        }
+        ...ObligationsPageFragment
       }
     }
   }
@@ -40,8 +47,6 @@ export const obligationNodeQuery = graphql`
     node(id: $obligationId) {
       ... on Obligation {
         id
-        snapshotId
-        sourceId
         area
         source
         requirement