feat: trace quotation source provenance

[yigitcan-ozturk]

What changed

• attach namespaced rfqdiff_source provenance to every file-loaded quotation
• record source filename, input format and SHA-256 fingerprint
• record CSV row numbers and XLSX row/sheet locations
• reserve rfqdiff_source so input data cannot spoof tool-generated provenance
• carry provenance through scoring and machine-readable JSON output
• add source provenance columns to CSV/XLSX comparison reports
• add dedicated provenance tests and adapt quote-loading coverage
• document integrity scope and remove provenance from the roadmap

Compatibility

• scoring semantics and configurable weights are unchanged
• existing upstream metadata such as currency normalization remains preserved
• only file-loaded quotations gain the additive rfqdiff_source field
• full local filesystem paths are not embedded in output

Security and audit boundary

The SHA-256 fingerprint supports input integrity and traceability. It is not a digital signature and does not prove quotation authorship or approval.

Why

Procurement comparisons need a reproducible link between a scored supplier row and the input artifact that produced it. This adds that traceability without turning rfqdiff into a document-authentication system.