feat: compliance hardening for EU grant readiness

LICENSE & detection:
- Replace abbreviated LICENSE with full EUPL-1.2 text (fixes GitHub 'Unknown')
- Replace LICENSE-DATA stub with full CC-BY-4.0 legal code
- Update LICENSES/ directory with full texts + CC-BY-4.0.txt

REUSE.toml license model fix:
- Code/tooling: EUPL-1.2
- Graph data, vocabs, schemas, docs, exports: CC-BY-4.0
- Source assertions: EUPL-1.2
- Gov HTML snapshots: LicenseRef-Gov-PublicDomain (generic, multi-jurisdiction)
- 321/321 files pass reuse lint

New compliance artifacts:
- CITATION.cff for GitHub 'Cite this repository' widget
- sonar-project.properties for SonarCloud analysis
- .github/workflows/sonar.yml (SonarCloud CI)
- .github/workflows/sqaaas.yml (EOSC-Synergy SQAaaS assessment)

Coverage reporting:
- Add @vitest/coverage-v8 + test:coverage script
- Add lcov/json-summary reporters to vitest.config.ts
- Update ci.yml: run coverage + upload to Codecov

README: add Codecov and SonarCloud badges

Author: TommiLindfors

.github/workflows/ci.yml

@@ -33,8 +33,15 @@ jobs:
       - name: Lint (ESLint)
         run: pnpm lint
 
-      - name: Unit tests
-        run: pnpm test
+      - name: Unit tests with coverage
+        run: pnpm test:coverage
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage/lcov.info
+          fail_ci_if_error: false
 
   validate-graph:
     name: Validate graph data

.github/workflows/sonar.yml

@@ -0,0 +1,41 @@
+# SPDX-FileCopyrightText: 2025-2026 CLARVIA ASBL, Luxembourg
+# SPDX-License-Identifier: EUPL-1.2
+
+name: SonarCloud
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  sonarcloud:
+    name: SonarCloud Analysis
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - uses: pnpm/action-setup@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version-file: ".node-version"
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run tests with coverage
+        run: pnpm test:coverage
+
+      - name: SonarQube Scan
+        uses: SonarSource/sonarqube-scan-action@v5
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/sqaaas.yml

@@ -0,0 +1,26 @@
+# SPDX-FileCopyrightText: 2025-2026 CLARVIA ASBL, Luxembourg
+# SPDX-License-Identifier: EUPL-1.2
+
+name: SQAaaS Assessment
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  sqaaas:
+    name: SQAaaS Quality Assessment
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: SQAaaS Assessment
+        uses: EOSC-synergy/sqaaas-assessment-action@v2
+        with:
+          repo: "https://github.com/clarvia-org/clarvia-graph"
+          branch: "main"

CITATION.cff

@@ -0,0 +1,34 @@
+cff-version: 1.2.0
+message: "If you use this software, please cite it as below."
+title: "Clarvia Graph: Open Consequence Graph for Bereavement Administration"
+type: software
+version: 0.1.0-alpha.0
+doi: 10.5281/zenodo.20572455
+date-released: "2026-06-06"
+license: EUPL-1.2
+url: "https://clarvia.org"
+repository-code: "https://github.com/clarvia-org/clarvia-graph"
+abstract: >-
+  An open, source-backed consequence graph modelling administrative workflows
+  triggered by bereavement across European jurisdictions. Maps official
+  government sources to structured tasks, deadlines, conditions, and evidence
+  requirements. Aligned with CPSV-AP, CCCEV, ELI, and PROV-O.
+authors:
+  - family-names: "Lindfors"
+    given-names: "Tommi"
+    affiliation: "CLARVIA ASBL, Luxembourg"
+keywords:
+  - bereavement
+  - administrative workflows
+  - knowledge graph
+  - consequence graph
+  - legal ontology
+  - public services
+  - cross-border
+  - Luxembourg
+  - CPSV-AP
+  - CCCEV
+  - ELI
+  - PROV-O
+  - civic tech
+  - open data