[FEAT] Knowledge Base RAG multi-livello (SYSTEM/FIRM/ORG) + Qdrant + Voyage

- KnowledgeBaseController: ingest, list, firmOrgs, search, delete
- VectorService (Qdrant + buildAuthzFilter), EmbedService (Voyage), RagService (pipeline)
- AIService::askWithRag con fallback graceful
- docker-compose: servizio qdrant + env Voyage (chiave da .env/vault, no hardcoded)
- SQL 012 consulting_firms, 013 firm_assignments + kb_uploaded_documents
- public/kb.html + kb.js (upload, lista, search preview)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker/docker-compose.yml

@@ -13,6 +13,7 @@ services:
       - ../application:/var/www/nis2-agile/application
       - ../public:/var/www/nis2-agile/public
       - nis2-uploads:/var/www/nis2-agile/public/uploads
+      - /opt/devenv/scripts/vault-entrypoint.sh:/usr/local/bin/vault-entrypoint.sh:ro
     env_file:
       - ../.env
     environment:
@@ -25,8 +26,18 @@ services:
       - DB_PASS=${DB_PASS}
       - JWT_SECRET=${JWT_SECRET}
       - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
+      - VOYAGE_API_KEY=${VOYAGE_API_KEY}
+      - VOYAGE_MODEL=${VOYAGE_MODEL:-voyage-3-lite}
+      - QDRANT_URL=http://172.21.0.5:6333
+      - VAULT_STEWARD_URL=https://vault-steward:8443
+      - VAULT_APP_TOKEN=${VAULT_APP_TOKEN_NIS2}
+      - VAULT_PREFIX=tier1__nis2-app__
+      - VAULT_REQUIRED=true
+    entrypoint: ["/usr/local/bin/vault-entrypoint.sh"]
+    command: ["docker-php-entrypoint", "php-fpm"]
     networks:
       - nis2-network
+      - vault-net
     depends_on:
       db:
         condition: service_healthy
@@ -76,14 +87,30 @@ services:
     networks:
       - nis2-network
 
+  # -- Qdrant Vector DB (Migration 012-014: KB multi-livello) -- 
+  qdrant:
+    image: qdrant/qdrant:v1.7.4
+    container_name: nis2-qdrant
+    restart: unless-stopped
+    mem_limit: 512m
+    volumes:
+      - nis2-qdrant-data:/qdrant/storage
+    networks:
+      - nis2-network
+
 # ── Volumes ──────────────────────────────────────────────────────────────
 volumes:
   nis2-db-data:
     driver: local
   nis2-uploads:
     driver: local
+  nis2-qdrant-data:
+    driver: local
 
 # ── Networks ─────────────────────────────────────────────────────────────
 networks:
   nis2-network:
     driver: bridge
+  vault-net:
+    external: true
+    name: vault-net