Add implemented state and justification to controls

Introduce `implemented` enum (IMPLEMENTED/NOT_IMPLEMENTED) and
`not_implemented_justification` (nullable text) fields on the Control
entity across all API surfaces (GraphQL, MCP, CLI), database, frontend,
and SOA export.

The database stores implementation state as a PostgreSQL enum
`control_implementation_state`. Controls default to IMPLEMENTED during
migration. The SOA list and PDF export show implementation status
alongside applicability, with "-" for non-applicable controls.
Justification columns are renamed for clarity: "Justification for
non-applicability" and "Justification for non-implementation".

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/control_implementation_state.go

@@ -0,0 +1,66 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"database/sql/driver"
+	"fmt"
+)
+
+type (
+	ControlImplementationState string
+)
+
+const (
+	ControlImplementationStateImplemented    ControlImplementationState = "IMPLEMENTED"
+	ControlImplementationStateNotImplemented ControlImplementationState = "NOT_IMPLEMENTED"
+)
+
+func (s ControlImplementationState) IsValid() bool {
+	switch s {
+	case ControlImplementationStateImplemented, ControlImplementationStateNotImplemented:
+		return true
+	}
+	return false
+}
+
+func (s ControlImplementationState) String() string {
+	return string(s)
+}
+
+func (s ControlImplementationState) MarshalText() ([]byte, error) {
+	return []byte(s.String()), nil
+}
+
+func (s *ControlImplementationState) UnmarshalText(data []byte) error {
+	val := ControlImplementationState(data)
+	if !val.IsValid() {
+		return fmt.Errorf("invalid ControlImplementationState value: %q", string(data))
+	}
+	*s = val
+	return nil
+}
+
+func (s *ControlImplementationState) Scan(value any) error {
+	val, ok := value.(string)
+	if !ok {
+		return fmt.Errorf("invalid scan source for ControlImplementationState, expected string got %T", value)
+	}
+	return s.UnmarshalText([]byte(val))
+}
+
+func (s ControlImplementationState) Value() (driver.Value, error) {
+	return s.String(), nil
+}