feat: PDF / CSV report export for compliance

[notyorch]

Overview

Organizations using TUP for AI governance need to produce audit-ready reports for compliance frameworks (SOC 2, ISO 42001, internal security reviews). Currently there is no way to export detection data outside the dashboard.

Problem

• No way to share alert history with auditors or stakeholders
• Dashboard data is not portable
• Blocks adoption in regulated industries

Proposed Solution

Add export endpoints to tup-manager and download buttons in tup-dashboard.

Export Formats

Format	Use Case
CSV	Data analysis, import into Excel / Google Sheets
PDF	Formal compliance reports with branding

CSV Fields

timestamp, event_id, model_id, event_type, severity, confidence, detected_by, payload_summary

PDF Report Sections

1. Cover page (org name, date range, generated by TUP)
2. Executive summary (total events, breakdown by severity)
3. Top 10 detected threats table
4. Timeline chart (events over time)
5. Raw events appendix

Changes Required

Backend (tup-manager)

• Add GET /api/v1/events/export?format=csv&from=&to= endpoint
• Add GET /api/v1/reports/generate?from=&to= endpoint for PDF
• Integrate a PDF library (e.g. reportlab for Python or puppeteer via sidecar)
• Scope exports to authenticated workspace

Frontend (tup-dashboard)

• "Export CSV" button on Events table
• "Generate Report" button on Dashboard overview
• Date range picker for export scope

Acceptance Criteria

• CSV export downloads correctly with proper headers
• PDF renders without layout errors
• Export is scoped to current workspace only
• Large exports (10k+ events) stream without timeout

Priority

🟡 Low — needed for enterprise/compliance use cases, not MVP-blocking