Add finding and obligation publish to document system

Replace the old snapshot-based approach with the new publish document
system for findings and obligations. Includes GraphQL mutations, MCP
tools, CLI commands, e2e tests, frontend publish dialogs, and
snapshot-to-document migration tools.

Remove snapshot mode entirely from findings and obligations: drop
snapshotId from GraphQL schemas, filters, resolvers, MCP spec, frontend
routes, pages, and helpers. The snapshot_id column remains in the
database but is now filtered out with snapshot_id IS NULL.

Remove auditor's ability to publish SoA.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/console/v1/graphql/audit.graphql

@@ -138,7 +138,6 @@ input FindingOrder {
 }
 
 input FindingFilter {
-    snapshotId: ID
     kind: FindingKind
     status: FindingStatus
     priority: FindingPriority
@@ -171,7 +170,7 @@ type Audit implements Node {
         last: Int
         before: CursorKey
         orderBy: FindingOrder
-        filter: FindingFilter = { snapshotId: null }
+        filter: FindingFilter
     ): FindingConnection @goField(forceResolver: true)
 
     trustCenterVisibility: TrustCenterVisibility!
@@ -183,7 +182,6 @@ type Audit implements Node {
 
 type Finding implements Node {
     id: ID!
-    snapshotId: ID
     organization: Organization @goField(forceResolver: true)
     kind: FindingKind!
     referenceId: String!
@@ -270,6 +268,19 @@ extend type Mutation {
     deleteFindingAuditMapping(
         input: DeleteFindingAuditMappingInput!
     ): DeleteFindingAuditMappingPayload
+    publishFindingList(
+        input: PublishFindingListInput!
+    ): PublishFindingListPayload!
+}
+
+input PublishFindingListInput {
+    organizationId: ID!
+    approverIds: [ID!]
+}
+
+type PublishFindingListPayload {
+    documentEdge: DocumentEdge!
+    documentVersionEdge: DocumentVersionEdge!
 }
 
 input CreateAuditInput {

pkg/server/api/console/v1/graphql/control.graphql

@@ -139,7 +139,6 @@ type Control implements Node {
         last: Int
         before: CursorKey
         orderBy: ObligationOrder
-        filter: ObligationFilter
     ): ObligationConnection! @goField(forceResolver: true)
 
     snapshots(

pkg/server/api/console/v1/graphql/obligation.graphql

@@ -51,14 +51,8 @@ input ObligationOrder
     field: ObligationOrderField!
 }
 
-input ObligationFilter {
-    snapshotId: ID
-}
-
 type Obligation implements Node {
     id: ID!
-    snapshotId: ID
-    sourceId: ID
     organization: Organization! @goField(forceResolver: true)
     area: String
     source: String
@@ -94,6 +88,19 @@ extend type Mutation {
     createObligation(input: CreateObligationInput!): CreateObligationPayload!
     updateObligation(input: UpdateObligationInput!): UpdateObligationPayload!
     deleteObligation(input: DeleteObligationInput!): DeleteObligationPayload!
+    publishObligationList(
+        input: PublishObligationListInput!
+    ): PublishObligationListPayload!
+}
+
+input PublishObligationListInput {
+    organizationId: ID!
+    approverIds: [ID!]
+}
+
+type PublishObligationListPayload {
+    documentEdge: DocumentEdge!
+    documentVersionEdge: DocumentVersionEdge!
 }
 
 input CreateObligationInput {

pkg/server/api/console/v1/graphql/organization.graphql

@@ -150,13 +150,15 @@ type Organization implements Node {
         orderBy: AuditOrder
     ): AuditConnection! @goField(forceResolver: true)
 
+    findingsDocument: Document @goField(forceResolver: true)
+
     findings(
         first: Int
         after: CursorKey
         last: Int
         before: CursorKey
         orderBy: FindingOrder
-        filter: FindingFilter = { snapshotId: null }
+        filter: FindingFilter
     ): FindingConnection @goField(forceResolver: true)
 
     auditLogEntries(
@@ -247,13 +249,14 @@ type Organization implements Node {
         filter: MeasureFilter
     ): MeasureConnection! @goField(forceResolver: true)
 
+    obligationsDocument: Document @goField(forceResolver: true)
+
     obligations(
         first: Int
         after: CursorKey
         last: Int
         before: CursorKey
         orderBy: ObligationOrder
-        filter: ObligationFilter = { snapshotId: null }
     ): ObligationConnection! @goField(forceResolver: true)
 
     processingActivities(

pkg/server/api/console/v1/graphql/risk.graphql

@@ -107,7 +107,6 @@ type Risk implements Node {
         last: Int
         before: CursorKey
         orderBy: ObligationOrder
-        filter: ObligationFilter
     ): ObligationConnection! @goField(forceResolver: true)
 
     createdAt: Datetime!

pkg/server/api/console/v1/graphql/snapshot.graphql

@@ -3,14 +3,6 @@ enum SnapshotsType
     RISKS @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeRisks")
     VENDORS
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeVendors")
-    FINDINGS
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeFindings"
-        )
-    OBLIGATIONS
-        @goEnum(
-            value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeObligations"
-        )
     PROCESSING_ACTIVITIES
         @goEnum(
             value: "go.probo.inc/probo/pkg/coredata.SnapshotsTypeProcessingActivities"