[FEAT] Asset import CMDB/cloud + scoring automatico GV.OC-04 (P2)

- AssetScoringService::inferCriteria: euristica 6 criteri da campi CMDB
  (criticality, data_classification, internet_facing, dependencies, regulated)
- AssetController::import (JWT org_admin/compliance_manager) + bulkUpsert condiviso:
  upsert dedup su external_ref, scoring auto GV.OC-04, max 1000 asset/batch
- ServicesController::ingestAssets -> POST /services/assets-ingest (scope ingest:assets) per connettori CMDB/cloud
- Migrazione 025: assets += external_ref + discovery_source + indice univoco dedup
- Route POST:assetsIngest (services) + POST:import (assets)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

application/controllers/ServicesController.php

@@ -2561,6 +2561,26 @@ class ServicesController extends BaseController
         return $monStatus;
     }
 
+    /**
+     * POST /api/services/assets-ingest
+     * Auth: X-API-Key con scope ingest:assets
+     * Import asset da CMDB/cloud con scoring automatico GV.OC-04.
+     * Body: { "source":"cmdb|aws|azure", "assets":[ {...}, ... ] }
+     */
+    public function ingestAssets(): void
+    {
+        $this->requireApiKey('ingest:assets');
+        $body   = $this->getJsonBody();
+        $source = strtolower((string) ($body['source'] ?? 'cmdb'));
+        $items  = $body['assets'] ?? null;
+        if (!is_array($items) || !$items) {
+            $this->jsonError('Campo "assets" (array) obbligatorio', 422, 'VALIDATION');
+        }
+        require_once __DIR__ . '/AssetController.php';
+        $result = AssetController::bulkUpsert($this->currentOrgId, $items, $source, null);
+        $this->jsonSuccess($result, 'Asset importati', 201);
+    }
+
     /**
      * GET /api/services/controls-monitoring
      * Auth: X-API-Key con scope read:compliance