[SEC+UX] Hardening sicurezza + miglioramenti UX pre-audit

SICUREZZA:
- index.php: rimosso CORS wildcard in debug mode (solo origini autorizzate)
- AuthController: getClientIP() con X-Forwarded-For sicuro (proxy-aware)
- AuthController: refresh token con SELECT FOR UPDATE in transazione atomica
- AIService: anonimizzazione dati org nei prompt Anthropic API (no nome/fatturato)

UX AUDIT-READY:
- dashboard.html: gauge rinominato 'Avanzamento implementazione misure Art.21'
- incidents.html: decision tree Art.23 con 5 criteri per 'Is Significant?'
- policies.html: banner warning obbligatorio su bozze generate da AI
- risks.html: tooltip dettagliati scala Likelihood/Impact (ISO 27005)
- assessment.html: progress bar % completamento risposta domande

DB:
- migration 006: indici performance + audit_log immutabile (trigger) + soft delete

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

public/assessment.html

@@ -44,6 +44,20 @@
                     <!-- Steps Indicator -->
                     <div class="steps" id="steps-indicator"></div>
 
+                    <!-- Progress Bar -->
+                    <div style="margin-bottom:16px;">
+                        <div style="display:flex; justify-content:space-between; align-items:center; margin-bottom:6px;">
+                            <span style="font-size:0.78rem; font-weight:600; color:var(--gray-600);">Avanzamento risposta domande</span>
+                            <span style="font-size:0.78rem; font-weight:700; color:var(--primary);" id="progress-pct">0%</span>
+                        </div>
+                        <div style="background:var(--gray-200); border-radius:99px; height:8px; overflow:hidden;">
+                            <div id="progress-bar-fill" style="height:100%; background:var(--primary); border-radius:99px; transition:width 0.3s ease; width:0%;"></div>
+                        </div>
+                        <div style="font-size:0.7rem; color:var(--gray-400); margin-top:4px;">
+                            <span id="progress-answered">0</span> di <span id="progress-total">0</span> domande con risposta
+                        </div>
+                    </div>
+
                     <!-- Question Card -->
                     <div class="card mb-24">
                         <div class="card-header">
@@ -295,6 +309,22 @@
             }
         }
 
+        function updateProgressBar() {
+            const total = questions.length;
+            const answered = Object.values(responses).filter(r => r && r.answer).length;
+            const pct = total > 0 ? Math.round((answered / total) * 100) : 0;
+
+            const pctEl = document.getElementById('progress-pct');
+            const fillEl = document.getElementById('progress-bar-fill');
+            const answeredEl = document.getElementById('progress-answered');
+            const totalEl = document.getElementById('progress-total');
+
+            if (pctEl) pctEl.textContent = pct + '%';
+            if (fillEl) fillEl.style.width = pct + '%';
+            if (answeredEl) answeredEl.textContent = answered;
+            if (totalEl) totalEl.textContent = total;
+        }
+
         function renderCurrentQuestion() {
             if (categories.length === 0) return;
 
@@ -365,6 +395,7 @@
             `;
 
             document.getElementById('question-area').innerHTML = html;
+            updateProgressBar();
 
             // Navigation buttons
             document.getElementById('btn-prev').disabled = (currentCategoryIdx === 0 && currentQuestionIdx === 0);