[WM-BW-3] Categorization is a Low/Moderate/High picker with no FIPS 199 / SP 800-60 walkthrough

## WM-BW-3 — No FIPS 199 / SP 800-60 Walkthrough in Categorization Step

**Category:** Broken ATO/RMF Workflow | **Priority:** High
**Regulation:** FIPS 199, SP 800-60 Vol 1 & 2

### Observation
Categorization is implemented as a simple Low/Moderate/High dropdown. There is no information type identification workflow, no per-type C/I/A impact derivation, and no system high-water mark computation. `DEFAULT_IMPACT_LEVEL=Moderate` env var observed, confirming impact defaults rather than being derived.

### Evidence
- `DEFAULT_IMPACT_LEVEL=Moderate` env var in code search
- Categorization sub-page blank (issue #634)

### Impact
Impact levels are not derived from documented information types. Resulting categorization is undefensible to an AO and does not satisfy FIPS 199 or SP 800-60 methodology requirements.

### Acceptance Criteria
- [ ] Information type identification workflow implemented (SP 800-60 Vol 2 catalog)
- [ ] Per-type C/I/A impact selection with SP 800-60 provisional values as defaults
- [ ] System high-water mark automatically computed
- [ ] Remove or override-gate `DEFAULT_IMPACT_LEVEL` env var
- [ ] Categorization record stores full derivation, not just final impact level