Compliance Templates — Slice 7: single-active activation + safe/destructive edit guards

[larsgeorge-db]

Parent PRD

#676

What to build

Make template lifecycle safe and single-source-of-truth:

• Single active per entity type — activating a template deactivates the previously active one for that entity type (backed by the partial unique index from Compliance Templates — Slice 1: skeleton (define→fill→read a single String field) #706).
• Safe edits take effect immediately — add a field, edit label/hint/default, add an enum value.
• Destructive edits are guarded — changing a field's value type, removing a field, or narrowing an enum's allowed values must be blocked/guarded so already-stored product values aren't silently invalidated. Mirror the cert-levels delete-guard pattern (count_entities_using_level → 409).

See PRD user stories 10–13.

Acceptance criteria

• Activating a template deactivates the previously active one for that entity type; only one ever in force
• Attempting a second active template for an entity type is rejected (index-backed)
• Safe edits (add field, edit label/hint/default, add enum value) apply immediately
• Destructive edits (type change, field removal, enum narrowing) are guarded when stored values exist (e.g. 409 with a clear message)
• Guard mirrors the cert-levels in-use conflict pattern

Blocked by

• Blocked by Compliance Templates — Slice 1: skeleton (define→fill→read a single String field) #706
• Blocked by Compliance Templates — Slice 2: all value types + typed inputs + value-type engine #707

User stories addressed

• User story 10
• User story 11
• User story 12
• User story 13