feat(diia-city): BRAVE1/EU4UA compliance stack — MySQL DDL, n8n workflow, Zapier Tables, NIS2/DORA IAM/PQC docs

[romanchaa997]

Summary

This PR adds the full AuditorSEC compliance stack for Diia.City, EU4UA, and BRAVE1 defence-tech anti-corruption grant workflows.

Changes

MySQL (mysql/)

• schema.sql — Full DDL for auditorsec_diia database:
  • suppliers table (EDRPOU, sanctions, risk score, screening status)
  • contracts table (compliance status, IAM review required)
  • price_benchmarks table (deviation %, review status)
  • grants_risk_dossiers table (MFA enforced, PQC roadmap, crypto inventory, GPRC status)
  • Bakhmach pilot sample INSERT data

n8n (n8n/)

• diia_brave1_workflow.json — Weekly compliance workflow:
  • Cron trigger (Monday 08:00 UTC)
  • MySQL queries: high-risk suppliers, price deviations >20%, pending IAM/PQC grant dossiers
  • Code node: aggregates report data
  • Email send: HTML report to compliance@auditorsec.eu

Docs (docs/)

• nis2-dora-iam-pqc.md — NIS2/DORA IAM & PQC controls:
  • IAM requirements table (MFA, least privilege, access reviews, shared account ban)
  • PQC requirements table (crypto inventory, CRYSTALS-Kyber/Dilithium pilot, EU roadmap sync)
  • Risk assessment matrix (R-IAM-01/02/03, R-PQC-01/02, R-SOC-01)
  • GPRC ClickUp status block with checkpoints and active freezes
  • Zapier Tables mapping
• bakhmach-pilot-setup.md — Bakhmach pilot setup guide:
  • Sample SQL data for all 4 tables
  • n8n import steps
  • Zapier Zaps integration table
  • NIS2/DORA compliance checklist

Zapier Assets (external, personal folder)

4 Tables created:

• EU4UA-BRAVE1 | Suppliers & Screening (11 fields)
• EU4UA-BRAVE1 | Contracts & Monitoring (14 fields)
• EU4UA-BRAVE1 | Price Benchmarks (13 fields)
• EU4UA-BRAVE1 | Grants & Risk Dossiers (16 NIS2/DORA-aligned fields)

3 Zaps created (drafts, ready to activate):

• Supplier Risk Screening Alert
• Price Deviation Flag (>20%)
• Grant Intake & NIS2 Dossier Alert

Compliance Alignment

• NIS2 (EU 2022/2555) Art.21: IAM, MFA, access reviews, crypto inventory
• DORA (EU 2022/2554) Art.9: IAM controls, PQC roadmap
• EU PQC Roadmap 2024: CRYSTALS-Kyber/Dilithium transition planning
• EU4UA/BRAVE1: Anti-corruption supplier screening, price benchmarking, grant dossier controls
• Diia.City: Bakhmach pilot with sample data

Deadline: 18 April 2026 (NIS2/DORA IAM/PQC)

Active Freezes:

• SOC/MDR expansion (no new third-party integrations)
• Shared accounts (no new generic accounts)
• Persistent VPN/PAM access without expiry