[FEAT] ISO-readiness: Audit interni (§9.2) + Riesame Direzione (§9.3) + Calendario scadenze (mig.055-056, v1.22.0)

Rilascio unico (3 moduli) costruito in flotta parallela + verifica avversariale.

MODULO A — Audit interni (ISO 27001 §9.2, mig.055): internal_audits + internal_audit_items;
codice AUD-NNN; checklist pre-popolata (clausole 4-10 + Annex A applicabili dal SoA);
esiti per riga; apertura non conformità collegata a NCR/CAPA (source polimorfico);
report HTML stampabile. InternalAuditController + internal-audits.html.

MODULO B — Riesame di Direzione (ISO 27001 §9.3, mig.056): management_reviews +
management_review_decisions; codice RD-AAAA-NN; INPUT aggregati automaticamente dai
moduli (gather: NC/CAPA, audit interni, rischi+trattamenti, KPI/score, obiettivi, formazione,
stakeholder, normative, scadenze), congelati nello snapshot all'approvazione; decisioni;
verbale stampabile. ManagementReviewController + management-review.html.

MODULO C — Calendario unico scadenze: aggregatore SOLA LETTURA (nessuna migrazione) di tutte
le scadenze (incidenti/policy/rischi/NC-CAPA/formazione/stakeholder/audit/riesame/review_schedule),
griglia mensile + lista + filtri + deep-link. CalendarController + calendario.html.

Integrazione: router (3 controller+actionMap), api.js, sidebar V2+legacy, help.js (3 sezioni),
i18n (IT+EN), review_schedule ENUM += internal_audit. v1.22.0 + sw cache + cache-buster 20260630.

Verifica flotta (28 agenti, 4 dim + avversariale): 9 finding confermati, TUTTI corretti —
MAJOR gatherRisks (risk_treatments.organization_id inesistente → JOIN risks); nextCode numerico
(no dup >99/anno); footer report audit con etichetta "ISO buona prassi, non obbligo"; help 24→25
clausole; ARIA tab/calendario; focus modali; tasti su celle calendario; rimossi helper api morti.

Smoke prod OK (calendario 18 eventi, audit AUD-001 25 item + report + audit→NCR + audit→calendario,
riesame gather/decisione/approve/report, gatherRisks ora available); org 151 ripulita. Additivo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

public/js/api.js

@@ -221,6 +221,7 @@ class NIS2API {
     // ═══════════════════════════════════════════════════════════════════
     orgRolesList() { return this._acn(this.get('/org-roles/list')); }
     orgRolesAssignableUsers() { return this._acn(this.get('/org-roles/assignable-users')); }
+    orgMembers() { return this._acn(this.get('/organizations/' + (this.orgId || '') + '/members')); }
     orgRoleGet(id) { return this._acn(this.get(`/org-roles/${id}`)); }
     orgRoleCreate(data) { return this._acn(this.post('/org-roles/create', data || {})); }
     orgRoleUpdate(id, data) { return this._acn(this.put(`/org-roles/${id}`, data)); }
@@ -333,6 +334,43 @@ class NIS2API {
     stkActAddComment(id, d) { return this._acn(this.post(`/stakeholder-activities/${id}/comments`, d || {})); }
     stkActAttachments(id) { return this._acn(this.get(`/stakeholder-activities/${id}/attachments`)); }
 
+    // ── Audit interni (Modulo A — ISO 27001 §9.2) ──
+    intAuditList() { return this._acn(this.get('/internal-audits/list')); }
+    intAuditGet(id) { return this._acn(this.get(`/internal-audits/${id}`)); }
+    intAuditCreate(data) { return this._acn(this.post('/internal-audits/create', data || {})); }
+    intAuditUpdate(id, data) { return this._acn(this.put(`/internal-audits/${id}`, data)); }
+    intAuditDelete(id) { return this._acn(this.del(`/internal-audits/${id}`)); }
+    intAuditAddItem(data) { return this._acn(this.post('/internal-audits/items', data || {})); }
+    intAuditUpdateItem(itemId, data) { return this._acn(this.put(`/internal-audits/items/${itemId}`, data)); }
+    intAuditRaiseNcr(id, data) { return this._acn(this.post(`/internal-audits/${id}/raise-ncr`, data || {})); }
+
+    // ── Riesame di Direzione (ISO 27001 §9.3, Modulo B) ──
+    mgmtReviewList() { return this._acn(this.get('/management-reviews/list')); }
+    mgmtReviewGet(id) { return this._acn(this.get(`/management-reviews/${id}`)); }
+    mgmtReviewCreate(data) { return this._acn(this.post('/management-reviews/create', data || {})); }
+    mgmtReviewUpdate(id, data) { return this._acn(this.put(`/management-reviews/${id}`, data || {})); }
+    mgmtReviewGather() { return this._acn(this.get('/management-reviews/gather')); }
+    mgmtReviewAddDecision(id, data) { return this._acn(this.post(`/management-reviews/${id}/decisions`, data || {})); }
+    mgmtReviewUpdateDecision(subId, data) { return this._acn(this.put(`/management-reviews/decisions/${subId}`, data || {})); }
+    mgmtReviewApprove(id) { return this._acn(this.post(`/management-reviews/${id}/approve`, {})); }
+
+    // ── Calendario unico scadenze (Modulo C) — aggregatore sola lettura ──
+    calendarEvents(params) {
+        const qs = new URLSearchParams();
+        if (params && params.from) qs.set('from', params.from);
+        if (params && params.to) qs.set('to', params.to);
+        if (params && params.types) qs.set('types', Array.isArray(params.types) ? params.types.join(',') : params.types);
+        const q = qs.toString();
+        return this._acn(this.get('/calendar/events' + (q ? '?' + q : '')));
+    }
+    calendarSummary(params) {
+        const qs = new URLSearchParams();
+        if (params && params.from) qs.set('from', params.from);
+        if (params && params.to) qs.set('to', params.to);
+        const q = qs.toString();
+        return this._acn(this.get('/calendar/summary' + (q ? '?' + q : '')));
+    }
+
     // ═══════════════════════════════════════════════════════════════════
     // Dashboard
     // ═══════════════════════════════════════════════════════════════════