[Bug]: Risk treatment response is omitted from reports and exports

## Summary

Generated reports omit the risk treatment response (`accept`, `mitigate`, `transfer`, or `avoid`). Risks with different governance decisions therefore become indistinguishable in report data, the report UI, Word output, and CSV export.

## Steps to reproduce

1. Create a threat model and a risk.
2. Set the risk's Response to **Accept**.
3. Generate any report containing the Risk Register or export its risks as CSV/Word.
4. Inspect the report and generated report payload.

## Actual behavior

The risk is present with its inherent/residual scores and owner, but its response is absent from the generated report data and every downstream output.

## Expected behavior

The report contract and all relevant renderers/exports should preserve and label the risk response, including an explicit unset state.

## Reproduction against current `main`

Reproduced against [`4f429a8`](https://github.com/precogly/precogly/commit/4f429a8d4e7c9b0192cf5b6cd0826db702bbebf4) using a migrated PostgreSQL test database. A risk persisted with `response="accept"` was passed through `_build_risks()`; the regression assertion failed with:

```text
KeyError: 'response'
```

The report builder omits the model field:

https://github.com/precogly/precogly/blob/4f429a8d4e7c9b0192cf5b6cd0826db702bbebf4/backend/apps/threat_models/report_service.py#L728-L739

The frontend report type also has no response field:

https://github.com/precogly/precogly/blob/4f429a8d4e7c9b0192cf5b6cd0826db702bbebf4/frontend/src/features/reports/types/report.ts#L206-L220

The risk CSV has no Response column:

https://github.com/precogly/precogly/blob/4f429a8d4e7c9b0192cf5b6cd0826db702bbebf4/frontend/src/features/reports/utils/csvExport.ts#L95-L114

## Impact

The principal decision about what the organization will do with a risk is missing from its handoff and audit artifact. Reviewers cannot distinguish an accepted risk from one intended for mitigation or transfer.

Start with backend/apps/threat_models/report_service.py at _build_risks() and the failing regression assertion described in the issue. Then inspect frontend/src/features/reports/types/report.ts and frontend/src/features/reports/utils/csvExport.ts, along with the report renderers and exports. Done means the response, including an explicit unset state, is preserved and labeled in report data, the report UI, Word output, and CSV export.

Written by the indexing model from the issue text.