Unified company snapshot (verify + roles + VAT + employer + risk)

Returns ONE normalized snapshot of a Norwegian organisation — verify + roles + VAT + employer + risk — composed from the SAME handlers the dedicated endpoints use, so an agent can orient in a single round-trip instead of chaining /verify → /authority → /context. NO new government access: the only upstreams touched are the ones /context and /authority already touch (Brønnøysund, NAV Aa-registeret, Fullmakttjenesten). Partial-failure tolerant — the five sub-sources are composed via Promise.allSettled, so a single sub-source that throws degrades ONLY its own field to { status: "degraded", error } while the other four stay populated and the call still returns 200. The base company facts are the one hard prerequisite: a non-existent org returns 404 and a Brønnøysund outage with no serviceable cache returns 503. data.employer.available: false (with a reason) is a legitimate success outcome when the caller has no NAV delegation — it is NOT a degraded sub-object. data.risk is a transparency-only reflection of the BRREG distress signals, never a credit score. _meta.served_from / _meta.stale reflect the underlying context cache state. Every successful call writes a company.snapshot audit_log row.