Get Risk Citations

The requirements each of these risks cites, rendered from the revisions that were judged.

Batched over risk ids rather than one route per risk: the risk list asks about every card on screen at once, and a request per card is the shape that makes a twenty-risk analysis twenty round trips.

Capped like its sibling: an uncapped repeated query param is an IN list whose size the caller chooses. The client chunks well below this cap for a different reason — a request near it is ~11 KB of URL, past what a default proxy will accept — so this bound is the server's own floor against a hand-made request, not the number the UI sends.

The query itself lives in helpers/marketing_requirement_citations.py, shared with the rollout-consistency run viewer, which renders these same blocks for staff without a masquerade.