AcceptRiskTool bypasses active-authorization guard (risk acceptance allowed with no active ATO)

## Security Gap — RMF Business Logic

### Summary

The integration test `AcceptRisk_NoActiveAuth_ReturnsError` fails because `AcceptRiskTool.ExecuteCoreAsync` routes through `DeviationService.CreateDeviationAsync`, which has **no active-authorization guard**. The guard that throws `"No active authorization decision for system"` lives in `AuthorizationService.AcceptRiskAsync` (~line 265) — a **different code path** that `AcceptRiskTool` never calls.

### Root Cause

Introduced when `AcceptRiskTool` was refactored to use `DeviationService` (commit `40e9e50`, Epic #124). As a result, a user can accept risk on a system with **no active authorization decision** — an incorrect RMF state transition.

### Impact

A caller can invoke `AcceptRiskTool` against a system that has never received an Authorization to Operate (ATO) and the operation will succeed. This violates RMF process correctness: risk acceptance is only a valid action when an active authorization decision exists for the system.

### Recommended Fix

At the top of `AcceptRiskTool.ExecuteCoreAsync`, add an active-authorization guard:

```csharp
var hasActiveAuth = await db.AuthorizationDecisions
.Where(d => d.RegisteredSystemId == systemId && d.IsActive)
.AnyAsync();

if (!hasActiveAuth)
return Error("No active authorization decision for system — risk acceptance not permitted.");
```

Re-enable and verify against the existing `AcceptRisk_NoActiveAuth_ReturnsError` integration test.

### Verification

- Existing test: `AcceptRisk_NoActiveAuth_ReturnsError` (currently failing)
- Once fix is applied, this test must pass without modification

### Remediation Group

Phase 3 — RMF Correctness. Slot alongside #673, #674, #669, #830.

> **This is NOT a blocker for PR #828.**

### Labels
`security` · `high` (RMF process correctness)

Start at AcceptRiskTool.ExecuteCoreAsync and compare its DeviationService.CreateDeviationAsync path with the guard in AuthorizationService.AcceptRiskAsync. Re-enable or verify the existing AcceptRisk_NoActiveAuth_ReturnsError integration test; done means the test passes and risk acceptance returns the specified error when no active authorization decision exists.

Written by the indexing model from the issue text.