feat(devex): add the compliance service to the bruno api collection

[tiana-code]

E-09 DevEx #303 (F-09.4 remainder) - add the compliance service to the Bruno API collection. The collection (from #237) covered ledger/payments/decision; compliance was built later and was the missing piece.

What

8 new api/collection/compliance/*.bru, mirroring the existing payments/ledger format (bearer from {{token}}, scopes documented per request):

• Initiate KYC session (POST, Idempotency-Key, compliance:write), Get KYC session (GET, read)
• Open case (POST, write), List cases (GET ?status=, read), Get case (GET, read), Claim / Resolve / Escalate case (POST, write)

Plus: environments/sandbox.bru gains complianceUrl (8083 placeholder), kycSessionId, caseId; README adds the compliance scopes row, the KYC-initiation idempotency note, and the compliance placeholder service.

Source-fidelity

Endpoints, methods and bodies verified against KycController/CaseController (CreateKycSessionRequest {subjectReference}, OpenCaseRequest {reference}); no invented fields. compliance/decision aren't in compose, so their URLs are documented standalone placeholders.

Gate chain

• security-auditor (opus): PASS - no hardcoded tokens (all {{token}} from the empty env), gitleaks clean, clean-room clean, localhost placeholders only.
• code-reviewer: CHANGES-REQUIRED, both findings declined with evidence - the "List cases duplicates ?status=" claim is disproven by the merged ledger/List accounts.bru which uses the identical url+params:query dual form (Bruno keeps them in sync, not additive); the "Open case no Idempotency-Key" is advisory and correctly mirrors the backend (case-open isn't idempotency-gated).
• evaluator: PASS (0.93).
  Data-only collection (no code/CI); merge-gate is structural fidelity to the backend + the existing exemplar.

Closes #303