[FEAT] A4 Fase 4.3 — Matrice RACI + link m2m: raci_assignments + procedure_inventory/procedure_risk/inventory_risk/risk_measure (mig.043), RaciController org-scoped (anti-IDOR, validazione object/measure), raci.html+raci.js (Bootstrap Italia/AGID), routing+sidebar+api+help+i18n. Build+review adversariale via workflow (0 finding critical/major). Cache-buster ?v=20260619.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

public/index.php

@@ -88,6 +88,7 @@ $controllerMap = [
     'organizations' => 'OrganizationController',
     'org-roles'     => 'OrgRoleController',          // A4 Fase 4.1 — Organigramma (ruoli/gerarchia, Art.23 governance)
     'competences'   => 'CompetenceController',       // A4 Fase 4.2 — Competenze (skill, requisiti ruolo, gap, alert->azione)
+    'raci'          => 'RaciController',              // A4 Fase 4.3 — Matrice RACI + link m2m (procedure/inventario/rischi/misure)
     'assessments'   => 'AssessmentController',
     'acn-gap'       => 'AcnAssessmentController',    // Gap Analysis ACN (Det. 164179/2025, misure/requisiti)
     'isms'          => 'IsmsModelController',        // Modello Organizzativo SGSI (ISO 27001/27017/27018 + SoA)
@@ -223,6 +224,17 @@ $actionMap = [
         'POST:openAction'             => 'openAction',
     ],
 
+    // ── RaciController — Matrice RACI + link m2m (A4 Fase 4.3) ──
+    'raci' => [
+        'GET:matrix'      => 'matrix',
+        'POST:assign'     => 'assign',
+        'DELETE:assign'   => 'unassign',
+        'GET:objects'     => 'objects',
+        'GET:links'       => 'links',
+        'POST:link'       => 'link',
+        'DELETE:link'     => 'unlink',
+    ],
+
     // ── AssessmentController ────────────────────────
     'assessments' => [
         'GET:list'                  => 'list',