[W8] #419 follow-up: Step 2 parse-polling for async OSCAL sessions

## Context

PR #511 aligned the OSCAL Import Wizard to the approved API contract but did not implement Step 2 parse-polling.

The contract defines:

> Step 2 — Poll `GET /import/status/{sessionId}` until `parseStatus == "Complete"`

Current behavior: the 202 response from `POST /api/v1/systems/import/oscal-ssp` is treated as synchronous — the wizard advances to Step 2 immediately and uses the `validationStatus` from the upload response.

## Risk

If the backend ever returns `parseStatus: "Parsing"` on the 202 (valid for large SSPs near the 50 MB limit), the UI will render an incomplete or incorrect `validationStatus` before parsing finishes.

## Required Action Before W8 E2E Testing

1. **Cyborg (backend):** Confirm whether parsing is guaranteed synchronous for all valid file sizes (≤ 50 MB) OR document the maximum async parse window.
2. If async is possible: Mr. Terrific implements Step 2 skeleton + polling loop using `GET /api/v1/systems/import/oscal-ssp/{sessionId}/status` (or equivalent endpoint defined by backend).
3. Contract updated to reflect the resolution.

## Acceptance Criteria

- [ ] Backend team documents parsing behavior (sync/async, max latency) in `oscal-api-contract.md`
- [ ] If async: wizard Step 2 shows "Parsing…" skeleton and polls until `parseStatus == "Complete"`
- [ ] Round-trip E2E test covers the async path (upload → poll → validate → preview → commit)

**Owner:** Cyborg (backend clarification) + Mr. Terrific (UI if async path needed)
**Dependency:** #510 (backend OSCAL endpoints), #511 (frontend wizard)
**Wave:** W8 pre-E2E