Add implemented state and justification to controls

Introduce `implemented` enum (IMPLEMENTED/NOT_IMPLEMENTED) and
`not_implemented_justification` (nullable text) fields on the Control
entity across all API surfaces (GraphQL, MCP, CLI), database, frontend,
and SOA export.

The database stores implementation state as a PostgreSQL enum
`control_implementation_state`. Controls default to IMPLEMENTED during
migration. The SOA list and PDF export show implementation status
alongside applicability, with "-" for non-applicable controls.
Justification columns are renamed for clarity: "Justification for
non-applicability" and "Justification for non-implementation".

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

e2e/console/mapping_test.go

@@ -83,6 +83,7 @@ func TestControlMeasureMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control for mapping",
 			"sectionTitle": "Section 1",
 			"bestPractice": true,
+			"implemented":  "IMPLEMENTED",
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -362,6 +363,7 @@ func TestControlDocumentMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"bestPractice": true,
+			"implemented":  "IMPLEMENTED",
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -503,6 +505,7 @@ func TestControlAuditMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"bestPractice": true,
+			"implemented":  "IMPLEMENTED",
 		},
 	}, &createControlResult)
 	require.NoError(t, err)
@@ -640,6 +643,7 @@ func TestControlSnapshotMapping_CreateDelete(t *testing.T) {
 			"description":  "Test control",
 			"sectionTitle": "Section 1",
 			"bestPractice": true,
+			"implemented":  "IMPLEMENTED",
 		},
 	}, &createControlResult)
 	require.NoError(t, err)