Add SSI provider platform

[Raafet57]

Summary

• adds the SSI Control Tower export-readiness ledger slice
• adds a source-agnostic provider platform for synthetic/offline DTCC ALERT, SwiftRef SSI Plus, CSV, and LexisNexis-style companion enrichment
• adds provider capability/health/conflict APIs plus /providers operator page
• adds synthetic provider demo fixtures and conflict/export-readiness regressions

Safety / scope

• synthetic/offline only
• no live DTCC, Swift/SwiftRef, LexisNexis, provider, LLM, or external API calls
• aggregate API/UI surfaces expose counts, roles, labels, dates, and rule metadata only
• privacy tests cover raw fixture BICs, account refs, source keys, entity IDs, names, and demo values
• no deploy/restart/merge performed

Verification

• git diff --check
• app: .venv/bin/python -m pytest -q -> 147 passed
• root: pnpm verify -> passed (lint, format, typecheck, vitest 230 passed, privacy audit, data checks, build)
• static scan -> clean
• independent review -> APPROVE / passed
• local smoke on temp DB/exports:
  • GET /providers -> 200 OK, 20408 bytes
  • GET /api/v1/providers -> total_providers 4, live_integrations 0, roles {authority:1, reference:2, companion:1}
  • POST /api/v1/providers/demo -> DTCC 2 imported/1 rejected, SwiftRef 1 imported, LexisNexis-style 2 imported; export_ready 1, export_blocked 2

Notes

• reviewer non-blocking suggestions: consider making provider import response more privacy-minimal, validate provider_id path format for clearer errors, and eventually use a companion-source allowlist rather than substring-based forbidden-value markers.