Add risk assessment boundary model

Introduce RiskAssessmentBoundary as a first-class, self-nesting entity that
groups nodes within a risk assessment scope, and thread it through every
surface.

- coredata: new risk_assessment_boundaries table + migration, boundary_id on
  nodes, self-referential parent_boundary_id, entity type registration
- riskmanagement: boundary CRUD service methods, boundary_id wiring on node
  create/update, scope-membership and self-parent validation, nested-subgraph
  Mermaid rendering
- IAM: core:risk-assessment-boundary:{get,list,create,update,delete} actions
  and viewer/auditor read policies
- console GraphQL: RiskAssessmentBoundary type, connection, order enum, CRUD
  mutations, boundaries field on scope, boundaryId on nodes
- CLI: risk-assessment boundary command group and --boundary-id on nodes
- MCP: boundary tools and boundary_id on node tools
- n8n: boundary operations and boundary fields on node operations
- console UI: boundary list/create/edit, boundary selector on nodes, diagram
  refetch on boundary changes

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

e2e/internal/factory/factory.go

@@ -1598,6 +1598,10 @@ func CreateRiskAssessmentNode(c *testutil.Client, scopeID string, attrs ...Attrs
 		"name":                  a.getString("name", SafeName("Node")),
 	}
 
+	if boundaryID := a.getString("boundaryId", ""); boundaryID != "" {
+		input["boundaryId"] = boundaryID
+	}
+
 	var result struct {
 		CreateRiskAssessmentNode struct {
 			RiskAssessmentNodeEdge struct {
@@ -1614,6 +1618,47 @@ func CreateRiskAssessmentNode(c *testutil.Client, scopeID string, attrs ...Attrs
 	return result.CreateRiskAssessmentNode.RiskAssessmentNodeEdge.Node.ID
 }
 
+func CreateRiskAssessmentBoundary(c *testutil.Client, scopeID string, attrs ...Attrs) string {
+	c.T.Helper()
+
+	var a Attrs
+	if len(attrs) > 0 {
+		a = attrs[0]
+	}
+
+	const query = `
+		mutation($input: CreateRiskAssessmentBoundaryInput!) {
+			createRiskAssessmentBoundary(input: $input) {
+				riskAssessmentBoundaryEdge { node { id } }
+			}
+		}
+	`
+
+	input := map[string]any{
+		"riskAssessmentScopeId": scopeID,
+		"name":                  a.getString("name", SafeName("Boundary")),
+	}
+
+	if parentID := a.getString("parentBoundaryId", ""); parentID != "" {
+		input["parentBoundaryId"] = parentID
+	}
+
+	var result struct {
+		CreateRiskAssessmentBoundary struct {
+			RiskAssessmentBoundaryEdge struct {
+				Node struct {
+					ID string `json:"id"`
+				} `json:"node"`
+			} `json:"riskAssessmentBoundaryEdge"`
+		} `json:"createRiskAssessmentBoundary"`
+	}
+
+	err := c.Execute(query, map[string]any{"input": input}, &result)
+	require.NoError(c.T, err, "createRiskAssessmentBoundary mutation failed")
+
+	return result.CreateRiskAssessmentBoundary.RiskAssessmentBoundaryEdge.Node.ID
+}
+
 func CreateRiskAssessmentProcess(c *testutil.Client, scopeID, sourceNodeID, targetNodeID string, attrs ...Attrs) string {
 	c.T.Helper()