Compliance Calendar

Idempotently populates obligations for every active entity. Re-running is safe — existing rows on matching (entity, type, due_date) are skipped.