feat: add multi-BU tenancy with per-user team scoping (Option B)

- Add bu_teams column to users table (migration + fresh schema)
- Create shared KNOWN_TEAMS constant and validateTeams helper
- Expose user teams in auth middleware, login, and /me responses
- Add bu_teams CRUD to user management routes with audit logging
- Make Ivanti FINDINGS_FILTERS configurable via IVANTI_BU_FILTER env var
- Add query-time team filtering to GET /findings and /findings/counts
- Update AuthContext with teams helpers and admin scope toggle
- Create AdminScopeToggle component (My Teams / All BUs)
- Scope ReportingPage findings fetch by user teams
- Scope CompliancePage team selector by user teams
- Scope ExportsPage findings exports by user teams
- Add BU teams multi-select to UserManagement create/edit forms
- Display team badges in user list table

backend/server.js

@@ -29,6 +29,7 @@ const { createComplianceRouter }       = require('./routes/compliance');
 const createAtlasRouter               = require('./routes/atlas');
 const createJiraTicketsRouter         = require('./routes/jiraTickets');
 const createCardApiRouter             = require('./routes/cardApi');
+const createFeedbackRouter            = require('./routes/feedback');
 
 const app = express();
 const PORT = process.env.PORT || 3001;
@@ -246,6 +247,9 @@ app.use('/api/jira-tickets', createJiraTicketsRouter(db));
 // CARD Asset Ownership API routes — proxy CARD operations, mutation flow, asset search
 app.use('/api/card', createCardApiRouter(db, requireAuth));
 
+// Feedback routes — bug reports and feature requests to GitLab
+app.use('/api/feedback', createFeedbackRouter(db, requireAuth));
+
 // ========== CVE ENDPOINTS ==========
 
 // Get all CVEs with optional filters (authenticated users)