…/iam/ec2/rds checks (CS-533)

Ports the toReadFailure error-visibility pattern from the merged S3 fix
(PR #3075) to the remaining AWS checks, so 'could not verify' findings
stop asserting unverified permission claims:

- new read-failure.ts module (shared.ts was over the file-size cap):
  toReadFailure gains a regionDisabled class (OptInRequired/AuthFailure
  from opted-out regions -> 'remove the region' advice instead of a
  useless 're-run'), plus combineReadFailures for aggregate findings and
  remediationForReadFailure as the single source of gated wording
- cloudtrail: GetTrailStatus/DescribeTrails failures carry readError in
  evidence with gated remediation; the factually wrong 'No CloudTrail
  configured' title (trails homed outside scanned regions are invisible)
  becomes 'No CloudTrail trail found' with scanned regions in evidence
- kms: per-key rotation finding carries readError; aggregate finding
  lists per-region errors and sample per-key errors
- iam: a non-NoSuchEntity password-policy read error no longer aborts
  the whole check (it was rethrowing, suppressing the independent
  root-MFA/root-access-key findings) — emits 'Could not verify IAM
  password policy' and continues
- ec2/rds: failedRegions evidence enriched to {region, error} pairs;
  rds dedupes per region preferring denied failures
- maxAttempts: 5 on all clients (parity with the S3 fix)

Pass/fail verdicts are unchanged except iam continuing instead of
aborting. Evidence is display-only (verified: no programmatic consumers).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…re-error-visibility

fix(integration-platform): surface real read errors in cloudtrail/kms/iam/ec2/rds checks (CS-533)

…ks (CS-534 part 1)

Ports the read-failure error-visibility pattern to the Azure and GCP
checks, closing the fully-swallowed error sites found in the CS-532
audit — '.catch(() => null)' paths that discarded the real error and
asserted a specific missing permission the code never verified:

- new src/manifests/http-read-failure.ts: toHttpReadFailure classifies
  ctx.fetch/ctx.post errors (.status 401/403 or PERMISSION_DENIED/
  AuthorizationFailed/Forbidden in the message = denied; else transient)
- azure sql (firewall rules + auditing), monitor (alerts + diagnostic
  settings), mysql/postgresql flexible (server configs), entra-id (role
  definition resolution), shared armListAllOrFail: real error now lands
  in finding evidence + logs; 'Grant X' remediation only when the error
  actually was an authorization failure
- gcp iam-primitive-roles (bare 'catch { return null }' sites now
  capture and surface the error), storage/cloud-sql/vpc project-level
  catches: remediation gated on the error class
- fixes the factually wrong storage getIamPolicy role hint:
  legacyBucketReader/Viewer do not contain storage.buckets.getIamPolicy;
  the hint now names roles/iam.securityReviewer

Pass/fail verdicts and control flow are unchanged — only remediation/
description/evidence/log text. ctx.fetch already retries 429/5xx, so no
retry changes were needed. 187 tests pass (12 new).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ds nullable

Addresses cubic review:
- CustomFrameworksSection: resync local state from initialCustomFrameworks via useEffect so refetched server data isn't ignored (mirrors the certificate-file resync in TrustPortalSwitch).
- ComplianceResourceResponseDto: framework/customFrameworkId are always present but nullable, so use @ApiProperty({ nullable: true }) instead of @ApiPropertyOptional — accurate OpenAPI contract (null, not undefined).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…meworks

feat(trust-portal): display custom frameworks on the Trust Portal

… AWS findings

Cubic flagged on PR #3086 that the new iam.ts password-policy finding
bypasses the shared attribution path — in a multi-account org the
merged task panel shows it with no way to tell which AWS account it
belongs to. The same gap existed in every account-level direct
ctx.fail finding: could-not-assume-role (shared.ts), the S3/EC2/RDS/
KMS/CloudTrail aggregate could-not-verify findings, and both iam.ts
findings.

Route all 9 sites through emitOutcomes, which stamps awsAccountId +
awsConnectionName into evidence and appends the account label to the
description (same as every per-resource finding since PR #3065).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…rrors

fix(integration-platform): surface real read errors in azure/gcp checks (CS-534 part 1)

…cription

feat(integration-platform): scan all enabled Azure subscriptions (CS-534 part 2)

…opt-in

Product decision: a deploy must never silently expand an existing
customer's scan scope. The resolver now scans multiple subscriptions
ONLY when the customer explicitly selects them in the subscription_ids
picker (selecting all = explicit scan-everything). Without a selection,
behavior is byte-identical to before the picker existed: the saved
subscription_id, else the first Enabled subscription — with a log line
pointing at the picker when more subscriptions are visible.

Scope-failure findings, the picker, the Add-button fix, and the
wildcard-scan isolation are unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…plicit finding

Cubic flagged that capping at 50 subscriptions left the gap visible
only in run logs. Scanning less than the customer explicitly selected
must never be silent: the cap now emits a 'selection exceeds the scan
limit' finding listing the unscanned subscription ids. Only reachable
via an explicit >50 selection (no-selection default scans one).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…wlist

feat(trust-portal): add per-email NDA-bypass allowlist

…ssion

Cubic P1: drag-and-drop bypassed the disabled gate the click path already
had, so read-only users (canUpdate=false → disabled) could upload
certificates by dropping a file.

- ComplianceFramework: handleDrop and handleDragEnter now early-return
  when disabled || isUploading (mirrors the gated click path), so
  read-only users get neither the drop affordance nor the upload
- CustomFrameworksSection: pass onFileUpload only when canUpdate
  (defense-in-depth; processFile already no-ops without the callback)
- new ComplianceFramework.test.tsx: asserts a dropped PDF uploads when
  editable and does NOT upload when disabled

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…-sweep

fix(trust): custom-frameworks feature sweep — drag-drop permission gate + 400-on-bad-body

…-rbac

fix(integrations): gate the Add-account CTA on integration:create RBAC