Vendor taxonomy

Reference vocabulary and risk weights. Clients select these values when creating a vendor — they can’t edit the list. Rarely changed; kept here as configuration, not a day-to-day content layer.