feat: fold SSI Control Tower hybrid flow

[Raafet57]

Summary

• Fold SSI Control Tower into apps/ssi-control-tower while keeping the root Payment Intelligence suite static/browser-only.
• Add hybrid CSV and SSI Plus V3 source adapters, canonical SSI instruction ingestion, source lineage, validation persistence, and unified instruction exception queues.
• Harden account-bearing import privacy: reject missing or unmasked account values instead of fabricating masked placeholders, and protect approval/PATCH/export flows.

Verification

• apps/ssi-control-tower: make test -> 80 passed
• apps/ssi-control-tower: ruff check . -> passed
• Repo root: pnpm verify -> ESLint, Prettier, typecheck, 226 Vitest tests, privacy audit, IBAN/BIC/CBPR checks, and build passed
• git diff --check and git diff --cached --check -> passed
• Staged static secret/security scan over 115 files -> 0 findings
• Codex read-only final pre-commit review -> APPROVE, blockers none