First-run wizard — ask what you need before dumping 64 controls

[aanishs]

What

When a founder runs /hipaa for the first time, ask 3 questions before importing controls:

1. What cloud provider? (AWS / GCP / Azure / none)
2. Do you store patient data? (determines PHI-specific checks)
3. Do you have a mobile app? (determines additional controls)

Then import only the relevant subset and skip irrelevant controls.

Why

Dumping 64 NIST controls on a founder who just wants to know if their Express.js app handles patient data correctly is overwhelming. A wizard narrows the scope to what matters.

Effort

M (human: ~1 week / CC: ~30 min)

[aanishs]

Largely addressed by #44 (merged): /comply v3 persona detection + Framework Advisor's guided onboarding questions, and the founder onramp asks its questions before dumping controls. Remaining gap vs. this issue's spec: importing only the relevant control subset (today all framework controls import; the interview scopes what's asked, not what's imported). Keeping open, rescoped to that gap.