feat: CTDL-ASN registry import and CASE alignment

[jeff-grann]

Summary

Adds the ability to import a CTDL-ASN competency framework from a Credential Engine registry into OpenCASE, view it in the editor and on the canvas, and align local CASE items to imported registry competencies (and to external frameworks) — with the registry provenance preserved end to end in a CASE-compliant way.

Imported frameworks open read-only and can be forked into an editable derivative on demand; alignments and provenance survive full save/reload round-trips.

What's included

Backend (apps/opencase)

• CredentialRegistryClient fetches a CTDL-ASN @graph. The default registry origin is configurable via CREDENTIAL_REGISTRY_BASE_URL; passing a full resource URL to import overrides it per request, so prod / sandbox / self-hosted registries work without reconfiguration.
• CtdlAsnToCaseMapper maps ceasn:CompetencyFramework / ceasn:Competency graphs to a CASE CFPackage, recording provenance under a unified ext:opencase.source block on the CFDocument and every CFItem.
• ImportFrameworkFromRegistry + PreviewRegistryFramework endpoints, wired through the management controller/routes and DI container.
• The document index derives isModifiedFromSource / sourcePackageURI from ext:opencase; a save of a still-locked registry import is no longer force-marked "modified".

Editor (apps/editor)

• Import-from-registry dialog + a read-only registry reference node.
• Read-only / fork workflow: imported frameworks block content and structural edits (layout stays editable); a header Enable editing action forks with confirmation, rewriting each node's ext:opencase.source → derivedFrom and flagging the document isModifiedFromSource.
• Alignment associations to registry and external-framework reference nodes are emitted on export; reference nodes are persisted in the document extension and reconstructed on load, and alignment edges are re-linked to the reconstructed nodes by destination URI (so they survive reload).
• CASE export correctness: a top-level item's isChildOf targets the CFDocument (not a bogus /CFItems/<docId> URI); a registry alignment's destination identifier is the CTID's UUID rather than a hash.

The ext:opencase extension contract

Provenance is recorded in a namespaced CASE extension (CASE 1.1 has no native CTID field):

"ext:opencase": {
  "source": {                     // faithfully-imported node
    "uri":      "https://credentialengineregistry.org/resources/ce-…",  // @id — authoritative
    "ctid":     "ce-…",           // convenience (derivable from uri)
    "registry": "https://credentialengineregistry.org",                 // disambiguates multi-registry
    "format":   "ctdl-asn"
  }
  // after fork, `source` becomes `derivedFrom` (same shape) and the document adds isModifiedFromSource: true
}

Alignment associations carry the target resource URL in destinationNodeURI.uri (mirrored in ext:opencase.ctdlDestinationUri / externalDestinationUri).

Testing

• Editor: full Vitest suite green, including new regression tests — toOpenCaseFormat (destination URIs), externalAlignment (association emitted + node persisted), alignmentRelink (edges re-link on reload), and the fork/provenance round-trip.
• Backend: mapper, CredentialRegistryClient base resolution, CreateFramework fork-index gating, and management controller tests pass.

Configuration / deployment

• New env var CREDENTIAL_REGISTRY_BASE_URL (default https://credentialengineregistry.org), surfaced in docker-compose.yml and docs/env.example.
• Backend changes require an image rebuild (docker-compose up --build).

🤖 Generated with Claude Code