Add finding and obligation publish to document system

Replace the old snapshot-based approach with the new publish document
system for findings and obligations. Includes GraphQL mutations, MCP
tools, CLI commands, e2e tests, frontend publish dialogs, and
snapshot-to-document migration tools.

Remove snapshot mode entirely from findings and obligations: drop
snapshotId from GraphQL schemas, filters, resolvers, MCP spec, frontend
routes, pages, and helpers. The snapshot_id column remains in the
database but is now filtered out with snapshot_id IS NULL.

Remove auditor's ability to publish SoA.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

packages/helpers/src/snapshots.ts

@@ -17,8 +17,6 @@ type Translator = (s: string) => string;
 export const snapshotTypes = [
   "RISKS",
   "VENDORS",
-  "FINDINGS",
-  "OBLIGATIONS",
   "PROCESSING_ACTIVITIES",
 ] as const;
 
@@ -32,12 +30,6 @@ export function getSnapshotTypeLabel(__: Translator, type: string | null | undef
       return __("Risks");
     case "VENDORS":
       return __("Vendors");
-    case "FINDINGS":
-    case "NONCONFORMITIES":
-    case "CONTINUAL_IMPROVEMENTS":
-      return __("Findings");
-    case "OBLIGATIONS":
-      return __("Obligations");
     case "PROCESSING_ACTIVITIES":
       return __("Processing Activities");
     default:
@@ -51,12 +43,6 @@ export function getSnapshotTypeUrlPath(type?: string): string {
       return "/risks";
     case "VENDORS":
       return "/vendors";
-    case "FINDINGS":
-    case "NONCONFORMITIES":
-    case "CONTINUAL_IMPROVEMENTS":
-      return "/findings";
-    case "OBLIGATIONS":
-      return "/obligations";
     case "PROCESSING_ACTIVITIES":
       return "/processing-activities";
     default: