feat: add SSI public evidence control tower

[Raafet57]

Summary

Implements the SSI Control Tower public-evidence command-centre slice:

• Adds sanitized public SSI/wire/settlement-instruction evidence artifacts using 11 official bank pages, storing only source URLs/titles and abstract field categories.
• Adds /api/v1/dashboard/operator-summary with today risk, T+1 blockers, pending approvals, aging exceptions, export readiness, and changed-since-yesterday counts.
• Polishes the Jinja dashboard into a stronger command-room view with rule-drilldown chips.
• Adds /exceptions/{exception_id} detail pages with root cause, impacted market/currency/asset, owner, recommended action, evidence required, approval path, audit trail, and SLA/age context.
• Adds read-only /demo and /demo/step/{n} guided import -> exception -> remediation -> approval -> export narrative from synthetic public-evidence-derived patterns.
• Adds /public-evidence page for the sanitized methodology/source list.

Privacy / scope guardrails

• No raw settlement values, account numbers, IBANs, routing numbers, source excerpts, hashes, or correspondent-chain details are committed.
• Demo fixtures are synthetic and account-bearing values contain literal ****.
• Demo routes are GET/read-only and covered by no-database-write tests.
• Root /ssi remains a static backend-module entry point. No iframe/proxy/root API/backend fetch/telemetry/storage coupling was added.
• Deployment/publication remains out of scope.

Verification

• Focused approval-path regression: 2 passed
• Focused SSI regression slice: 30 passed
• cd apps/ssi-control-tower && make test: 109 passed
• python3 -m ruff check apps/ssi-control-tower: passed
• pnpm verify: passed, including Vitest 230 passed
• pnpm test:e2e: 21 passed
• git diff --check: passed
• Changed-file secret/privacy scan: 24 changed files scanned, 3 SSI privacy files scanned, 0 findings
• Claude Code frontend/design review: APPROVE after requested fixes
• Codex final read-only diff review: APPROVE

Review notes

Codex previously requested two requirement-coverage fixes, both now covered by tests:

1. Dashboard now renders and exposes changed_since_yesterday.
2. Demo scenario now explicitly follows import -> exception -> remediation -> approval -> export.

Codex final review then requested explicit exception detail approval-path copy. The page now renders:

• Owner remediation
• Evidence attachment
• Four-eyes approval
• Export readiness

with regression coverage in tests/test_exception_detail_page.py.