feat: initial TrustOS platform scaffold

- FastAPI backend: auth, findings, dashboard, attack paths, footprint, AI translator, risk calculator, PDF report generator
- Next.js frontend: Vault dashboard, login, findings table, finding detail with AI coach, digital footprint, reports
- PostgreSQL data model: tenants, users, assets, findings, risk scores, audit reports, attack paths
- Docker Compose + Dockerfiles for all services
- Demo seed data: Acme Corp with 6 findings and 90-day risk score history
- AI Risk Translator (OpenAI/Anthropic) with plain-English business impact
- Role-based access: executive / it_admin / trustos_admin
- Scope-lock engine: authorization required before any assessment

Stage 1-8 complete: Phase 1 Vault Audit product ready

backend/app/api/routes/footprint.py

@@ -0,0 +1,88 @@
+from fastapi import APIRouter, Depends, HTTPException, Query
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select
+from typing import List
+
+from app.db.session import get_db
+from app.models.models import Finding, Executive, AuthorizedAsset
+from app.schemas.schemas import AuthorizedAssetCreate, AuthorizedAssetOut
+from app.core.security import require_admin, require_it_or_above
+
+router = APIRouter(prefix="/footprint", tags=["footprint"])
+
+
+@router.get("/{tenant_id}")
+async def get_footprint(
+    tenant_id: str,
+    payload: dict = Depends(require_it_or_above),
+    db: AsyncSession = Depends(get_db),
+):
+    if payload.get("role") != "trustos_admin" and payload.get("tenant_id") != tenant_id:
+        raise HTTPException(status_code=403, detail="Access denied")
+
+    # Digital footprint findings
+    from app.models.models import FindingCategory
+    fp_result = await db.execute(
+        select(Finding).where(
+            Finding.tenant_id == tenant_id,
+            Finding.category == FindingCategory.digital_footprint
+        )
+    )
+    footprint_findings = fp_result.scalars().all()
+
+    # Executives
+    exec_result = await db.execute(
+        select(Executive).where(Executive.tenant_id == tenant_id, Executive.is_enrolled == True)
+    )
+    executives = exec_result.scalars().all()
+
+    return {
+        "tenant_id": tenant_id,
+        "executives": [
+            {"id": e.id, "name": e.full_name, "title": e.title, "email": e.corporate_email}
+            for e in executives
+        ],
+        "footprint_findings": [
+            {
+                "id": f.id,
+                "title": f.title,
+                "severity": f.severity.value,
+                "ai_summary": f.ai_summary,
+                "status": f.status.value,
+                "source": f.source,
+            }
+            for f in footprint_findings
+        ],
+        "total_exposures": len(footprint_findings),
+    }
+
+
+@router.get("/authorized-assets/{tenant_id}", response_model=List[AuthorizedAssetOut])
+async def list_authorized_assets(
+    tenant_id: str,
+    payload: dict = Depends(require_it_or_above),
+    db: AsyncSession = Depends(get_db),
+):
+    if payload.get("role") != "trustos_admin" and payload.get("tenant_id") != tenant_id:
+        raise HTTPException(status_code=403, detail="Access denied")
+    result = await db.execute(
+        select(AuthorizedAsset).where(
+            AuthorizedAsset.tenant_id == tenant_id,
+            AuthorizedAsset.is_active == True
+        )
+    )
+    return result.scalars().all()
+
+
+@router.post("/authorized-assets/{tenant_id}", response_model=AuthorizedAssetOut, status_code=201)
+async def add_authorized_asset(
+    tenant_id: str,
+    body: AuthorizedAssetCreate,
+    payload: dict = Depends(require_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    asset = AuthorizedAsset(tenant_id=tenant_id, **body.model_dump())
+    db.add(asset)
+    await db.commit()
+    await db.refresh(asset)
+    return asset