Add implemented state and justification to controls

Introduce `implemented` enum (IMPLEMENTED/NOT_IMPLEMENTED) and
`not_implemented_justification` (nullable text) fields on the Control
entity across all API surfaces (GraphQL, MCP, CLI), database, frontend,
and SOA export.

The database stores implementation state as a PostgreSQL enum
`control_implementation_state`. Controls default to IMPLEMENTED during
migration. The SOA list and PDF export show implementation status
alongside applicability, with "-" for non-applicable controls.
Justification columns are renamed for clarity: "Justification for
non-applicability" and "Justification for non-implementation".

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/console/v1/schema.graphql

@@ -127,6 +127,20 @@ enum TrustCenterVisibility
         )
 }
 
+enum ControlImplementationState
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.ControlImplementationState"
+    ) {
+    IMPLEMENTED
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlImplementationStateImplemented"
+        )
+    NOT_IMPLEMENTED
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ControlImplementationStateNotImplemented"
+        )
+}
+
 enum TrustCenterDocumentAccessStatus
     @goModel(
         model: "go.probo.inc/probo/pkg/coredata.TrustCenterDocumentAccessStatus"
@@ -2221,6 +2235,8 @@ type Control implements Node {
     name: String!
     description: String
     bestPractice: Boolean!
+    implemented: ControlImplementationState!
+    notImplementedJustification: String
     regulatory: Boolean! @goField(forceResolver: true)
     contractual: Boolean! @goField(forceResolver: true)
     riskAssessment: Boolean! @goField(forceResolver: true)
@@ -4468,6 +4484,8 @@ input CreateControlInput {
     name: String!
     description: String
     bestPractice: Boolean!
+    implemented: ControlImplementationState!
+    notImplementedJustification: String
 }
 
 input UpdateControlInput {
@@ -4476,6 +4494,8 @@ input UpdateControlInput {
     name: String
     description: String @goField(omittable: true)
     bestPractice: Boolean
+    implemented: ControlImplementationState
+    notImplementedJustification: String @goField(omittable: true)
 }
 
 input DeleteControlInput {

pkg/server/api/console/v1/types/control.go

@@ -57,11 +57,13 @@ func NewControl(control *coredata.Control) *Control {
 		Framework: &Framework{
 			ID: control.FrameworkID,
 		},
-		SectionTitle: control.SectionTitle,
-		Name:         control.Name,
-		Description:  control.Description,
-		BestPractice: control.BestPractice,
-		CreatedAt:    control.CreatedAt,
-		UpdatedAt:    control.UpdatedAt,
+		SectionTitle:                control.SectionTitle,
+		Name:                        control.Name,
+		Description:                 control.Description,
+		BestPractice:                control.BestPractice,
+		Implemented:                 control.Implemented,
+		NotImplementedJustification: control.NotImplementedJustification,
+		CreatedAt:                   control.CreatedAt,
+		UpdatedAt:                   control.UpdatedAt,
 	}
 }

pkg/server/api/console/v1/v1_resolver.go

@@ -2945,11 +2945,13 @@ func (r *mutationResolver) CreateControl(ctx context.Context, input types.Create
 	control, err := prb.Controls.Create(
 		ctx,
 		probo.CreateControlRequest{
-			FrameworkID:  input.FrameworkID,
-			Name:         input.Name,
-			Description:  input.Description,
-			SectionTitle: input.SectionTitle,
-			BestPractice: input.BestPractice,
+			FrameworkID:                 input.FrameworkID,
+			Name:                        input.Name,
+			Description:                 input.Description,
+			SectionTitle:                input.SectionTitle,
+			BestPractice:                input.BestPractice,
+			Implemented:                 input.Implemented,
+			NotImplementedJustification: input.NotImplementedJustification,
 		},
 	)
 	if err != nil {
@@ -2977,11 +2979,13 @@ func (r *mutationResolver) UpdateControl(ctx context.Context, input types.Update
 	control, err := prb.Controls.Update(
 		ctx,
 		probo.UpdateControlRequest{
-			ID:           input.ID,
-			Name:         input.Name,
-			Description:  gqlutils.UnwrapOmittable(input.Description),
-			SectionTitle: input.SectionTitle,
-			BestPractice: input.BestPractice,
+			ID:                          input.ID,
+			Name:                        input.Name,
+			Description:                 gqlutils.UnwrapOmittable(input.Description),
+			SectionTitle:                input.SectionTitle,
+			BestPractice:                input.BestPractice,
+			Implemented:                 input.Implemented,
+			NotImplementedJustification: gqlutils.UnwrapOmittable(input.NotImplementedJustification),
 		},
 	)