Evidence type mgt.

Define the kinds of proof a control can require — not the files themselves. Actual uploaded documents live per tenant, on the reviewer side. This is the shared vocabulary the AI validator checks against.