[FEAT] Documenti istituzionali dashboard: backend + mig 065 (ticket #499)

Card 'Documenti istituzionali' resa funzionale (era stato vuoto onesto).
- mig 065: tabella institutional_documents (per-org, descrizione obbligatoria)
- InstitutionalDocsController: list/save/delete (org-scoped, org_admin+compliance_manager)
- 5 voci standard sempre presenti: Codice Etico, Mission, Vision, Statuto, Piano Sanzionatorio
- registrato in index.php controllerMap/actionMap

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

application/cli/migrate_065_institutional_documents.php

@@ -0,0 +1,27 @@
+<?php
+/**
+ * migrate_065_institutional_documents.php — Documenti istituzionali per-org (dashboard). IDEMPOTENTE.
+ * Ticket #499. Esegui: docker exec nis2-app php /var/www/nis2-agile/application/cli/migrate_065_institutional_documents.php
+ */
+if (PHP_SAPI !== 'cli') { http_response_code(403); exit("CLI only\n"); }
+require_once __DIR__ . '/../config/env.php';
+require_once __DIR__ . '/../config/database.php';
+$pdo = Database::getInstance();
+
+$pdo->exec("CREATE TABLE IF NOT EXISTS institutional_documents (
+    id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    organization_id INT NOT NULL,
+    doc_key VARCHAR(60) NULL,
+    title VARCHAR(200) NOT NULL,
+    description TEXT NOT NULL,
+    file_url VARCHAR(500) NULL,
+    is_standard TINYINT(1) NOT NULL DEFAULT 0,
+    sort_order INT NOT NULL DEFAULT 0,
+    created_by INT NULL,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+    UNIQUE KEY uq_instdoc_org_key (organization_id, doc_key),
+    INDEX idx_instdoc_org (organization_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci");
+echo "  + institutional_documents OK\n";
+echo "Migrazione 065 — documenti istituzionali OK. Prossima mig=066.\n";