[BUG] [KnowledgeBase/MCP] - kb_explain_nist_control returns 'not found' for all controls including AC-1 and AC-2 — NIST catalog lookup broken

## Bug Description
The `kb_explain_nist_control` tool consistently returns "Control X was not found in the NIST 800-53 catalog" for all controls, including well-established controls that are definitely present (AC-1, AC-2, etc.). The tool returns `success: true` but provides no control data, rendering the entire NIST control explanation feature non-functional.

## Steps to Reproduce
```bash
# AC-1 (Policy and Procedures — definitely in all NIST catalogs)
curl -s -X POST -H 'Content-Type: application/json' \
-d '{"message":"Explain AC-1"}' \
https://ca-ato-copilot-mcp-v2.blackwater-9393aa1a.centralus.azurecontainerapps.io/mcp/chat

# AC-2 (Account Management)
curl -s -X POST -H 'Content-Type: application/json' \
-d '{"message":"Explain NIST control AC-2"}' \
https://ca-ato-copilot-mcp-v2.blackwater-9393aa1a.centralus.azurecontainerapps.io/mcp/chat
```

## Expected Behavior
Returns full control description, enhancement list, implementation guidance, and related controls for any valid NIST SP 800-53 control identifier.

## Actual Behavior
Both responses return:
```
Control AC-2 was not found in the NIST 800-53 catalog.

The AC family (Access Control) is a valid NIST family. Try a specific control like AC-1 or AC-2.
```

Note the paradox: the error message suggests trying "AC-1 or AC-2" but when you try them they return the same "not found" error.

## Tool Details
- Tool invoked: `kb_explain_nist_control`
- `success: true` (tool did not error out — but returned empty result)
- `executionTimeMs: ~33-203ms`
- The NIST catalog health check reports: `"description": "NIST catalog operational (v5.2.0, 3/3 test controls valid, 0ms)"` — but these "test controls" may be different identifiers from the actual NIST 800-53 rev5 controls

## Root Cause (Likely)
The NIST catalog loaded internally may use different control ID formats (e.g., `ac-2` lowercase, or `AC-02` zero-padded) compared to what the tool lookup expects. Alternatively the catalog may be loaded with test/placeholder data that doesn't include the real control library.

## Impact
- All RMF control explanation features broken for users
- Any workflow requiring understanding of specific controls (AC-2, IA-5, SI-3, etc.) is blocked
- Compounds the existing `/mcp/chat` SYSTEM_REQUIRED issue — even basic guidance is unavailable

## Browser/Environment
- MCP API: https://ca-ato-copilot-mcp-v2.blackwater-9393aa1a.centralus.azurecontainerapps.io
- Health check confirms: NIST catalog v5.2.0, 3/3 test controls valid
- Date: 2026-07-09T12:46:00Z
- Sweep: Automated 4-hour QA sweep

## Playwright Test Code
```typescript
test('[KnowledgeBase] AC-1 control lookup returns actual control data', async () => {
const resp = await request.post('/mcp/chat', {
data: { message: 'Explain AC-1' }
});
const body = await resp.json();
expect(body.success).toBe(true);
expect(body.response).not.toContain('was not found in the NIST 800-53 catalog');
expect(body.response).toContain('AC-1');
expect(body.toolsExecuted.length).toBeGreaterThan(0);
});
```

*Filed by Oracle — Automated 4-hour QA Sweep 2026-07-09T12:46:00Z*