Add official procurement sources to XGuard commerce

[moelayyan90]

Adds a fail-closed official procurement ingestion layer to XGuard Global Commerce.

Production sources

• UK Find a Tender OCDS release package API: active tenders become buyer-demand evidence.
• UK Contracts Finder OCDS search API: secondary/legacy UK coverage.
• ECB EXR reference rates: currency normalization to USD with no guessed FX fallback.
• EU TED Search API adapter: parser is implemented, but zero/empty upstream responses create no synthetic demand.

Economic truth rules

• Public tender value is demand/budget evidence, never collected cash or secured buyer funding.
• Historic award winners are stored only in commerce_vendor_candidates; they are never promoted to live offers or inventory.
• CPV is the canonical product/category key for official procurement matching.
• Existing execution gates still require explicit buyer payment, buyer funds, buyer identity, supplier identity and supplier inventory verification before execution.

Runtime

• Adds D1 migration 0027_official_commerce_sources.sql for source telemetry and supplier candidates.
• Scheduler refreshes official sources at a bounded cadence with overlap to avoid missed updates, same-origin HTTPS pagination, response-size caps and page caps.
• Official-source refresh runs before opportunity rebuilding in the same mainnet cron cycle.
• Adds /v1/commerce/sources/status with aggregate operational state only.

Verification

Live probes confirmed Find a Tender and Contracts Finder currently return active tenders with CPV classifications, buyer identities/contact points, deadlines and contract values where published, plus historical awarded suppliers. ECB live data returned current reference FX observations. Dedicated parser/FX tests, formatting, ESLint, TypeScript, full CI, commerce execution checks, payment-security checks and CodeQL are required before merge.