Add risk assessment boundary model

Introduce RiskAssessmentBoundary as a first-class, self-nesting entity that
groups nodes within a risk assessment scope, and thread it through every
surface.

- coredata: new risk_assessment_boundaries table + migration, boundary_id on
  nodes, self-referential parent_boundary_id, entity type registration
- riskmanagement: boundary CRUD service methods, boundary_id wiring on node
  create/update, scope-membership and self-parent validation, nested-subgraph
  Mermaid rendering
- IAM: core:risk-assessment-boundary:{get,list,create,update,delete} actions
  and viewer/auditor read policies
- console GraphQL: RiskAssessmentBoundary type, connection, order enum, CRUD
  mutations, boundaries field on scope, boundaryId on nodes
- CLI: risk-assessment boundary command group and --boundary-id on nodes
- MCP: boundary tools and boundary_id on node tools
- n8n: boundary operations and boundary fields on node operations
- console UI: boundary list/create/edit, boundary selector on nodes, diagram
  refetch on boundary changes

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/coredata/risk_assessment_node.go

@@ -34,6 +34,7 @@ type (
 		ID                    gid.GID                `db:"id"`
 		OrganizationID        gid.GID                `db:"organization_id"`
 		RiskAssessmentScopeID gid.GID                `db:"risk_assessment_scope_id"`
+		BoundaryID            *gid.GID               `db:"boundary_id"`
 		NodeType              RiskAssessmentNodeType `db:"node_type"`
 		Name                  string                 `db:"name"`
 		CreatedAt             time.Time              `db:"created_at"`
@@ -105,6 +106,7 @@ SELECT
 	id,
 	organization_id,
 	risk_assessment_scope_id,
+	boundary_id,
 	node_type,
 	name,
 	created_at,
@@ -147,6 +149,7 @@ SELECT
 	id,
 	organization_id,
 	risk_assessment_scope_id,
+	boundary_id,
 	node_type,
 	name,
 	created_at,
@@ -212,6 +215,7 @@ SELECT
 	id,
 	organization_id,
 	risk_assessment_scope_id,
+	boundary_id,
 	node_type,
 	name,
 	created_at,
@@ -253,6 +257,7 @@ INSERT INTO risk_assessment_nodes (
 	tenant_id,
 	organization_id,
 	risk_assessment_scope_id,
+	boundary_id,
 	node_type,
 	name,
 	created_at,
@@ -262,6 +267,7 @@ INSERT INTO risk_assessment_nodes (
 	@tenant_id,
 	@organization_id,
 	@risk_assessment_scope_id,
+	@boundary_id,
 	@node_type,
 	@name,
 	@created_at,
@@ -273,6 +279,7 @@ INSERT INTO risk_assessment_nodes (
 		"tenant_id":                scope.GetTenantID(),
 		"organization_id":          n.OrganizationID,
 		"risk_assessment_scope_id": n.RiskAssessmentScopeID,
+		"boundary_id":              n.BoundaryID,
 		"node_type":                n.NodeType,
 		"name":                     n.Name,
 		"created_at":               n.CreatedAt,
@@ -295,6 +302,7 @@ func (n *RiskAssessmentNode) Update(ctx context.Context, conn pg.Tx, scope Scope
 	q := `
 UPDATE risk_assessment_nodes
 SET
+	boundary_id = @boundary_id,
 	node_type = @node_type,
 	name = @name,
 	updated_at = @updated_at
@@ -304,10 +312,11 @@ WHERE
 `
 	q = fmt.Sprintf(q, scope.SQLFragment())
 	args := pgx.StrictNamedArgs{
-		"id":         n.ID,
-		"node_type":  n.NodeType,
-		"name":       n.Name,
-		"updated_at": n.UpdatedAt,
+		"id":          n.ID,
+		"boundary_id": n.BoundaryID,
+		"node_type":   n.NodeType,
+		"name":        n.Name,
+		"updated_at":  n.UpdatedAt,
 	}
 	maps.Copy(args, scope.SQLArguments())