Sentinel integration — Replace Compliance Centre demo data with live queries

[TFT444]

Overview

Wire the Compliance Centre to pull real breach incident timestamps from Sentinel, feeding accurate ICO 72-hour and NCSC 24-hour countdown timers.

Queries to implement

• Latest high-severity data breach incident: SecurityIncident | where Severity == "High" and Classification == "TruePositive" | where Title has_any ("breach","exfil","data loss") | top 1 by CreatedTime
• Submission history: pull from a custom ComplianceSubmissions_CL table if it exists

Behaviour

• Timer starts from the CreatedTime of the most recent qualifying incident
• Falls back to demo data (hardcoded timestamp) when no workspace configured
• "Live" badge shown on countdown panel when using real data

Acceptance criteria

• ICO/NCSC timers driven by live incident timestamp when workspace configured
• "Live" badge shown on countdown cards
• Graceful fallback to demo mode
• No regression to existing demo behaviour

Part of

Epic #118 — Phase 2 Live Sentinel integration
Depends on: #136 (auth layer)