Add CMMI maturity level to compliance controls

Adds an optional CMMI 0-5 maturity level field to Control to support
ISO 27001 clause 9.1 effectiveness measurement and HITRUST CSF maturity
requirements. The field is nullable, framework-agnostic, and exposed
across all four API surfaces (GraphQL, MCP, CLI, n8n) plus the
generated SoA document.

Signed-off-by: Alejandro Juan <alejandrojuan@alejandrojuan.com>

pkg/probo/framework_service.go

@@ -74,6 +74,7 @@ type (
 				BestPractice                *bool   `json:"best_practice,omitempty"`
 				Implemented                 string  `json:"implemented,omitempty"`
 				NotImplementedJustification *string `json:"not_implemented_justification,omitempty"`
+				MaturityLevel               *string `json:"maturity_level,omitempty"`
 			} `json:"controls"`
 		}
 	}
@@ -612,6 +613,13 @@ func (s FrameworkService) Import(
 			if implemented == coredata.ControlImplementationStateNotImplemented {
 				notImplementedJustification = control.NotImplementedJustification
 			}
+			var maturityLevel *coredata.ControlMaturityLevel
+			if control.MaturityLevel != nil {
+				ml := coredata.ControlMaturityLevel(*control.MaturityLevel)
+				if ml.IsValid() {
+					maturityLevel = &ml
+				}
+			}
 			control := &coredata.Control{
 				ID:                          controlID,
 				FrameworkID:                 frameworkID,
@@ -622,6 +630,7 @@ func (s FrameworkService) Import(
 				BestPractice:                bestPractice,
 				Implemented:                 implemented,
 				NotImplementedJustification: notImplementedJustification,
+				MaturityLevel:               maturityLevel,
 				CreatedAt:                   now,
 				UpdatedAt:                   now,
 			}