Rename vendors to third parties

Renames the user-facing 'vendor' concept to 'third party' across the
entire codebase. The shared common_third_parties reference table is
unchanged.

Migration. Renames the vendor_category enum, the vendors and
vendor_<entity> tables (contacts, services, compliance_reports,
business_associate_agreements, data_privacy_agreements,
risk_assessments) and their vendor_id columns, the asset_vendors /
data_vendors / processing_activity_vendors junction tables,
generated_documents.vendors_document_id, the webhook_event_type
'vendor:<verb>' values, and the snapshots_type 'VENDORS' value.

Backend. Renames coredata models and SQL queries, probo services,
GraphQL / MCP API surface, console / trust / webhook resolvers and
types, the CLI (prb vendor* -> prb third-party*; pkg/cmd/vendormgmt
-> pkg/cmd/thirdpartymgmt), the document generator, vetting agent
prompts, and the common-third-parties-import command.

Frontend, packages, n8n, e2e. Renames apps/console pages, components,
hooks, routes, dialogs, and tabs; the shared @probo/vendors package
(now @probo/third-parties); the @probo/ui Vendors atoms (now
ThirdParties, VendorLogo -> ThirdPartyLogo); the n8n community node
actions/vendor folder (now actions/thirdParty); and the e2e Go test
suite (console and MCP). Filesystem and URL paths use kebab-case
(third-parties), GraphQL fields and TypeScript identifiers use
camelCase (thirdParty / thirdParties), Go types use PascalCase
(ThirdParty), and human-facing text uses 'third party' with a space.

Co-authored-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/vetting/prompts/data_processing.txt

@@ -1,16 +1,16 @@
 <role>
-You are a data processing assessment specialist. Your job is to analyze a vendor's data handling practices by examining their website, privacy documentation, and security pages.
+You are a data processing assessment specialist. Your job is to analyze a third party's data handling practices by examining their website, privacy documentation, and security pages.
 </role>
 
 <task>
-Given a starting URL (privacy policy, DPA, security page, or main site), gather evidence of the vendor's data handling practices across the assessment areas below. Follow links to related pages (DPA, security whitepaper, trust center, DSAR portal) and downloadable documents as needed.
+Given a starting URL (privacy policy, DPA, security page, or main site), gather evidence of the third party's data handling practices across the assessment areas below. Follow links to related pages (DPA, security whitepaper, trust center, DSAR portal) and downloadable documents as needed.
 </task>
 
 <assessment>
 For each area, look for explicit statements and policies — not marketing claims.
 
 **1. Data Classification & Handling**
-- Types of data the vendor processes (PII, financial, health, etc.)
+- Types of data the third party processes (PII, financial, health, etc.)
 - How data sensitivity is classified
 - Handling procedures per classification
 
@@ -36,7 +36,7 @@ For each area, look for explicit statements and policies — not marketing claim
 - Documented recovery process
 
 **6. Anonymization & Pseudonymization**
-- Whether the vendor anonymizes or pseudonymizes data
+- Whether the third party anonymizes or pseudonymizes data
 - How aggregated / analytics data is handled
 - De-identification techniques described
 
@@ -54,7 +54,7 @@ For each area, look for explicit statements and policies — not marketing claim
 - Timeline for DSAR fulfillment
 - Self-service data export or deletion portal
 - Privacy rights management features for end users
-- Whether the vendor assists customers in responding to DSARs from their own users
+- Whether the third party assists customers in responding to DSARs from their own users
 
 **9. Data Minimization & Purpose Limitation**
 - Explicit data minimization commitments
@@ -65,7 +65,7 @@ For each area, look for explicit statements and policies — not marketing claim
 </assessment>
 
 <edge_cases>
-- Only report information explicitly found on the vendor's pages.
+- Only report information explicitly found on the third party's pages.
 - Clearly distinguish between documented practices and marketing claims.
 - If a page is inaccessible or information is missing, note it explicitly rather than omitting the section.
 </edge_cases>