feat(ms-ai-architect): vendor playground-design-system v0.1 [skip-docs]

Initial sync of shared/playground-design-system/ into
plugins/ms-ai-architect/playground/vendor/playground-design-system/
via scripts/sync-design-system.mjs.

Source commit: f1fecf39b8fc20e86f6ec3c737f0dfda8403712e
Files: 25 (7 CSS + 11 fonts/licenses + 3 schemas + README + MANIFEST)

Vendored copy keeps the plugin standalone — playground will load CSS
from ./vendor/ regardless of where the plugin is installed.

Also adds .gitleaks.toml at repo root with a path allowlist for
vendored MANIFEST.json files (SHA-256 file hashes are not secrets).

Docs updated together with the playground HTML refactor that actually
consumes the vendored CSS (next commit). This commit is internal-only.

playground/vendor/playground-design-system/schemas/ros-threat.schema.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://playground-ds.no/schemas/ros-threat.json",
+  "title": "ROS-trussel",
+  "description": "Én identifisert trussel i en risiko- og sårbarhetsanalyse. NS 5814-justert.",
+  "type": "object",
+  "required": ["id", "title", "category", "inherent"],
+  "properties": {
+    "id":    { "type": "string", "pattern": "^T-[0-9]{3,}$" },
+    "title": { "type": "string" },
+    "description": { "type": "string" },
+    "category": {
+      "enum": ["personvern", "informasjonssikkerhet", "datakvalitet",
+              "compliance", "dataintegritet", "leverandørrisiko",
+              "tilgjengelighet", "omdømme", "økonomi", "andre"]
+    },
+    "actors": {
+      "type": "array",
+      "items": { "enum": ["intern-bruker", "saksbehandler", "innbygger", "ekstern-aktør", "leverandør", "system", "ai-modell"] }
+    },
+    "inherent": {
+      "type": "object",
+      "required": ["likelihood", "consequence"],
+      "properties": {
+        "likelihood":  { "type": "integer", "minimum": 1, "maximum": 5 },
+        "consequence": { "type": "integer", "minimum": 1, "maximum": 5 },
+        "rationale":   { "type": "string" }
+      }
+    },
+    "controls": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["id", "title"],
+        "properties": {
+          "id":     { "type": "string", "pattern": "^M-[0-9]{3,}$" },
+          "title":  { "type": "string" },
+          "kind":   { "enum": ["preventiv", "deteksjon", "korreksjon", "policy", "opplæring", "teknisk"] },
+          "status": { "enum": ["planlagt", "implementert", "validert", "ute-av-drift"] },
+          "owner":  { "type": "string" },
+          "due":    { "type": "string", "format": "date" }
+        }
+      }
+    },
+    "residual": {
+      "type": "object",
+      "properties": {
+        "likelihood":  { "type": "integer", "minimum": 1, "maximum": 5 },
+        "consequence": { "type": "integer", "minimum": 1, "maximum": 5 },
+        "rationale":   { "type": "string" }
+      }
+    },
+    "regulatory_refs": {
+      "type": "array",
+      "items": { "type": "string", "description": "GDPR Art. 35, AI Act Art. 6, NS 5814, …" }
+    },
+    "status": { "enum": ["open", "mitigating", "monitored", "closed", "transferred"], "default": "open" }
+  }
+}