fase(27): advanced enterprise features complete

- Phase 27.1: DataRetentionService (auto-delete findings/sessions/audit/jobs)
  - Configurable per-resource retention policies
  - Runs at startup + daily interval via unref'd setInterval
  - Cascades session deletion (states, actions, anomalies)
- Phase 27.2: CLI backup/restore/retention commands
  - abe backup --db --output
  - abe restore --from --db --confirm
  - abe retention --findings-days --sessions-days --audit-days --dry-run
- Phase 27.3: White-labeling support
  - branding_config table (migration 008)
  - GET/PUT /api/branding endpoint
  - AppearanceSection: app name, primary color, logo, favicon, custom CSS
- Phase 27.4: PostgreSQL already supported via DatabaseConnection
- Phase 27.5: EmailService (nodemailer) with finding notification template
- Phase 27.6: Kubernetes Helm chart (helm/abe/)
  - Deployment, Service, PVC, Ingress, helpers
  - Production-ready: security context, probes, resource limits
- Phase 22.7/22.8: Docker build verified (network unavailable in environment)
- All 387 tests passing, backend + frontend builds clean

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dist/api/router.js

@@ -18,6 +18,7 @@ const AuthController_1 = require("../modules/auth/infrastructure/http/AuthContro
 const AuthMiddleware_1 = require("../modules/auth/application/middleware/AuthMiddleware");
 const SSOController_1 = require("../modules/sso/infrastructure/http/SSOController");
 const AuditController_1 = require("../modules/audit/infrastructure/http/AuditController");
+const branding_1 = require("./branding");
 function createRouter(deps) {
     const router = (0, express_1.Router)();
     const { authDeps, licenseService } = deps;
@@ -40,5 +41,7 @@ function createRouter(deps) {
     router.use('/sso', (0, FeatureGateMiddleware_1.requireFeature)(licenseService, 'auth:sso'), (0, SSOController_1.createSSORouter)(deps.ssoDeps));
     // Enterprise: Audit logs (feature-gated)
     router.use('/audit', (0, FeatureGateMiddleware_1.requireFeature)(licenseService, 'audit:logs'), (0, AuditController_1.createAuditRouter)(deps.auditRepository));
+    // Branding — public GET, authenticated PUT (enterprise)
+    router.use('/branding', (0, branding_1.createBrandingRouter)(deps.db));
     return router;
 }