#3396 [comp] Production Deploy

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Persist applicability and justification on each organization’s SoA answer and apply the fully‑remote physical‑security (7.x) rule consistently in the UI and export. UI/PDF now read per-document answers, and completion counts and saves are scoped and validated for accuracy.

• New Features

  • Store per-org applicability on SOAAnswer and keep justification for both YES and NO.
  • UI and export read applicability/justification from document answers via shared resolveSoaDisplay; fully-remote orgs see 7.x controls as Not Applicable with a standard rationale, even before auto-fill persists it.
  • Accurate completion: count only latest answered rows whose questionId is in the document’s configured questions.
  • Safer saves: validate before write (require justification for Not Applicable), preserve omitted fields, and retire+create in a single transaction; reject answers for questions not in the document.

• Migration

  • Adds SOAAnswer.isApplicable; run DB migrations. Existing answers without a value render as N/A until re-filled (physical-security controls show Not Applicable for fully-remote orgs).