[compliance] Control-register report, pass-rate %, HIPAA seed completion

[xuyushun441-sys]

Remaining business increments for compliance:

• Control-register report (src/reports/) — grouped by framework with columns code/title/criticality/owner/last_status/last_assessed_at/overdue — the actual artifact handed to an auditor (no reports/ exists today).
• Pass-rate % metric on the dashboard (passing/total), not just raw counts.
• HIPAA seed completion — a HIPAA framework + 2 controls were added; add matching evidence + assessment rows so the HIPAA story is demoable end-to-end.

Follow-up from the 9-template optimization + 9.5.1 runtime-testing pass.