[FEAT] Services API, Webhook, Whistleblowing, Normative + integrazioni

Sprint completo — prodotto presentation-ready:

Services API (read-only, API Key + scope):
- GET /api/services/status|compliance-summary|risks-feed|incidents-feed
- GET /api/services/controls-status|assets-critical|suppliers-risk|policies-approved
- GET /api/services/openapi (spec OpenAPI 3.0.3 JSON)

Webhook Outbound (Stripe-like HMAC-SHA256):
- CRUD api_keys + webhook_subscriptions (Settings → 2 nuovi tab)
- WebhookService: retry 3x backoff (0s/5min/30min), delivery log
- Trigger auto in IncidentController, RiskController, PolicyController
- Delivery log, test ping, processRetry

Nuovi moduli:
- WhistleblowingController (Art.32 NIS2): anonimato garantito, timeline, token tracking
- NormativeController: feed NIS2/ACN/DORA con ACK tracciato per audit

Frontend:
- whistleblowing.html: form submit anonimo/firmato + gestione CISO
- normative.html: feed con presa visione documentata + progress bar ACK
- public/docs/api.html: documentazione API dark theme (Swagger-like)
- settings.html: tab API Keys + tab Webhook
- integrations/: guide per lg231, SustainAI, AllRisk, SIEM (widget + codice)
- Sidebar: Segnalazioni + Normative aggiunte a common.js

DB: migration 007 (api_keys, webhook_subscriptions, webhook_deliveries),
    008 (whistleblowing_reports + timeline),
    009 (normative_updates + normative_ack + seed NIS2/ACN/DORA/ISO)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

public/js/common.js

@@ -192,10 +192,12 @@ function loadSidebar() {
         {
             label: 'Gestione', i18nKey: 'nav.management',
             items: [
-                { name: 'Rischi',       href: 'risks.html',        icon: iconShieldExclamation(), i18nKey: 'nav.risks' },
-                { name: 'Incidenti',    href: 'incidents.html',    icon: iconBell(),              i18nKey: 'nav.incidents' },
-                { name: 'Policy',       href: 'policies.html',     icon: iconDocumentText(),      i18nKey: 'nav.policies' },
-                { name: 'Supply Chain', href: 'supply-chain.html', icon: iconLink(),              i18nKey: 'nav.supply_chain' },
+                { name: 'Rischi',       href: 'risks.html',          icon: iconShieldExclamation(), i18nKey: 'nav.risks' },
+                { name: 'Incidenti',    href: 'incidents.html',      icon: iconBell(),              i18nKey: 'nav.incidents' },
+                { name: 'Policy',       href: 'policies.html',       icon: iconDocumentText(),      i18nKey: 'nav.policies' },
+                { name: 'Supply Chain', href: 'supply-chain.html',   icon: iconLink(),              i18nKey: 'nav.supply_chain' },
+                { name: 'Segnalazioni', href: 'whistleblowing.html', icon: `<svg viewBox="0 0 20 20" fill="currentColor"><path fill-rule="evenodd" d="M5 9V7a5 5 0 0110 0v2a2 2 0 012 2v5a2 2 0 01-2 2H5a2 2 0 01-2-2v-5a2 2 0 012-2zm8-2v2H7V7a3 3 0 016 0z" clip-rule="evenodd"/></svg>` },
+                { name: 'Normative',    href: 'normative.html',      icon: `<svg viewBox="0 0 20 20" fill="currentColor"><path fill-rule="evenodd" d="M4 4a2 2 0 012-2h4.586A2 2 0 0112 2.586L15.414 6A2 2 0 0116 7.414V16a2 2 0 01-2 2H6a2 2 0 01-2-2V4zm2 6a1 1 0 011-1h6a1 1 0 110 2H7a1 1 0 01-1-1zm1 3a1 1 0 100 2h6a1 1 0 100-2H7z" clip-rule="evenodd"/></svg>` },
             ]
         },
         {
@@ -203,7 +205,7 @@ function loadSidebar() {
             items: [
                 { name: 'Formazione',    href: 'training.html', icon: iconAcademicCap(), i18nKey: 'nav.training' },
                 { name: 'Asset',         href: 'assets.html',   icon: iconServer(),      i18nKey: 'nav.assets' },
-                { name: 'Audit & Report',href: 'reports.html',    icon: iconChartBar(),    i18nKey: 'nav.audit' },
+                { name: 'Audit & Report',href: 'reports.html',  icon: iconChartBar(),    i18nKey: 'nav.audit' },
             ]
         },
         {