[FEAT] Modello Organizzativo SGSI (ISO 27001/27017/27018) + SoA pre-popolato da NIS2

Nuovo modulo guidato in 6 step (cl. 4-10 + Statement of Applicability):
- migration 037 (isms_models/roles/soa/documents) + 038 (dataset 111 controlli:
  93 Annex A:2022 + 7 CLD/27017 + 11 PII/27018) + runner scripts/migrate-isms.php
- IsmsModelController (16 endpoint) registrato in index.php
- SoA pre-popolato dalle risposte Gap Analysis NIS2 (mapping iso27001_control)
- estensioni cloud condizionali 27017/27018 via flag uses_public_cloud/
  is_cloud_provider/processes_pii_in_cloud
- AIService::generateIsmsDocument + fonti ISO in nis2_sources.php
- frontend isms.html/isms.js + api client + sidebar + help + i18n IT/EN
- ingest KB ISO (scope SYSTEM, solo titoli/sintesi: no testo coperto da copyright)
- version.json 1.14.0; doc studio + deploy handoff

Strumento di supporto/pre-audit (non certificazione). Migration DA APPLICARE su host.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

public/js/api.js

@@ -204,6 +204,26 @@ class NIS2API {
     acnReport(id) { return this._acn(this.get(`/acn-gap/${id}/report`)); }
     acnAiAnalyze(id) { return this._acn(this.post(`/acn-gap/${id}/aiAnalyze`, {})); }
 
+    // ═══════════════════════════════════════════════════════════════════
+    // Modello Organizzativo SGSI (ISO 27001/27017/27018) — vedi IsmsModelController
+    // Stesso contratto degli acn*: ritornano `data`, lanciano su success=false.
+    // ═══════════════════════════════════════════════════════════════════
+    ismsGetModel() { return this._acn(this.get('/isms/model')); }
+    ismsSaveModel(data) { return this._acn(this.post('/isms/model', data || {})); }
+    ismsAnnexControls() { return this._acn(this.get('/isms/annex-controls')); }
+    ismsGetSoa() { return this._acn(this.get('/isms/soa')); }
+    ismsDeriveSoa() { return this._acn(this.post('/isms/soa/derive', {})); }
+    ismsUpdateSoa(data) { return this._acn(this.put('/isms/soa', data)); }
+    ismsRoles() { return this._acn(this.get('/isms/roles')); }
+    ismsSaveRole(data) { return this._acn(this.post('/isms/roles', data)); }
+    ismsDeleteRole(id) { return this._acn(this.del(`/isms/roles/${id}`)); }
+    ismsDocuments() { return this._acn(this.get('/isms/documents')); }
+    ismsCreateDocument(data) { return this._acn(this.post('/isms/documents', data)); }
+    ismsAiGenerateDocument(data) { return this._acn(this.post('/isms/documents/ai-generate', data)); }
+    ismsUpdateDocument(id, data) { return this._acn(this.put(`/isms/documents/${id}`, data)); }
+    ismsReadiness() { return this._acn(this.get('/isms/readiness')); }
+    ismsExport() { return this._acn(this.get('/isms/export')); }
+
     // ═══════════════════════════════════════════════════════════════════
     // Dashboard
     // ═══════════════════════════════════════════════════════════════════