[AUD-004] AO Decision record type missing — Authorize RMF phase non-functional end-to-end

## Summary

**Severity:** P1 — Critical Workflow Gap
**Phase:** Phase 3 Remediation (Schema & Referential Integrity)
**Audit Reference:** SPIN Agent Product Integrity Report, Phase 1

## Finding

The Authorizing Official (AO) Decision record type does not exist in the data model. There is no entity, table, CRUD endpoint, or UI surface for capturing the AO's authorization decision (Authority to Operate, Interim ATO, Denial, etc.).

This makes the **Authorize** phase of the NIST RMF (SP 800-37 Step 5) non-functional end-to-end. Users cannot complete the authorization workflow, and the system cannot produce a compliant ATO package.

## Impact

- RMF Authorize phase (Step 5) is completely blocked
- Authorization export (related: #675) allows export with no AO decision on record
- No audit trail for AO acceptance/denial decisions
- Platform cannot support full RMF lifecycle for any system

## Current State

The platform supports Categorize, Select, Assess (partially), and document generation but has no model for:
- AO identity and designation
- Authorization decision (ATO / IATO / DATO)
- Authorization boundary approval
- Conditions and terms of authorization
- Authorization expiry / reauthorization dates

## Acceptance Criteria

- [ ] `AoDecision` entity created with: system FK, AO identity, decision type, decision date, expiry date, conditions, justification
- [ ] EF Core migration adds `AoDecisions` table
- [ ] CRUD API endpoints: POST/GET/PUT/DELETE `/api/dashboard/ao-decisions`
- [ ] UI surface for AO Decision capture in the Authorize phase workflow
- [ ] AO Decision required before authorization export is permitted
- [ ] Integration tests for full CRUD lifecycle

## Related

- #675 — Authorization export allowed without AO Risk Acceptance Statement
- #673 — SAP/SAR structural linkage
- #674 — POA&M/findings structural linkage
- Audit artifact: SPIN Agent Product Integrity Report (Phase 1)

Start by tracing the authorization export described in related issue #675 and the existing dashboard API and data-model patterns. Define the AoDecision entity and workflow integration from the listed acceptance criteria, then add the required CRUD, UI, export guard, migration, and full CRUD integration coverage. Done means the authorization workflow records decisions and cannot export without one.

Written by the indexing model from the issue text.