feat(metadata): add compliance snapshot mappings

[XiaoSeS]

Summary

Closes #556.

This PR adds optional SkillHub/Astron compliance metadata for skill versions:

• validates optional x-astron-compliance frontmatter during publish;
• snapshots normalized mappings into version parsedMetadataJson.complianceSnapshot;
• exposes the snapshot in version list/detail and review detail responses;
• renders a compact compliance mapping panel in skill/review version views;
• indexes standard, version, controlId, and title so searches like T1059 can find mapped skills.

Out of scope:

• no required compliance field;
• no independent compliance API;
• no runtime execution trace responsibility inside SkillHub;
• no dedicated compliance filter UI yet.

Validation

• Backend targeted tests:
  • ComplianceMetadataServiceTest
  • SkillPackageValidatorTest
  • SkillPublishServiceTest
  • ComplianceSnapshotProjectionServiceTest
  • ReviewSkillDetailAppServiceTest
  • SkillControllerTest
  • ReviewPortalControllerTest
  • PostgresSearchRebuildServiceTest
• Frontend:
  • pnpm --dir web exec vitest run src/features/skill/compliance-snapshot-panel.test.tsx src/features/review/review-skill-detail-section.test.tsx
  • pnpm --dir web run typecheck
  • pnpm --dir web run lint
• OpenAPI:
  • TMPDIR=<private-run-dir> ./scripts/check-openapi-generated.sh
• Local containerized staging:
  • built skillhub-server:staging
  • built web production assets
  • ran scripts/smoke-test.sh http://localhost:8080: 15 passed, 0 failed
• Runtime business check on staging:
  • published a zip package with x-astron-compliance
  • version detail returned complianceSnapshot.items[0].controlId = T1059
  • version list returned complianceSnapshot
  • search T1059 returned compliance-runtime-556

Notes

The local staging web container required a private compose override setting
SKILLHUB_TRUST_FORWARDED_PROTO=false because docker-compose.staging.yml uses nginx:alpine
directly rather than the web image default. compose.release.yml already carries this variable.
That staging-only gap is not changed in this PR.