fix: name matched risk inputs in policy scan banner and alerts (#1473)

The pre-deploy gate names the inputs that matched a scan policy (a
known-exploited CVE, a fixable Critical/High, or a severity threshold),
but the informational post-scan surfaces still framed every violation as
a severity ceiling. The scan detail banner read "blocks severities at or
above X, highest severity is Y" and the scheduled-scan alert read
"<severity> exceeds <maxSeverity>", which is wrong for a KEV- or
fixable-only policy that never gated on severity.

Persist the matched reasons on the policy evaluation, carry them on the
scheduled-scan violation, and render them on the banner so every policy
surface names the input that actually matched. Evaluations persisted
before this change carry no reasons: the parser defaults the field to an
empty array and the banner falls back to a plain violation notice.

frontend/src/types/security.ts

@@ -4,10 +4,16 @@ export type VulnSeverity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'UNKNOWN';
 export type VulnScanStatus = 'in_progress' | 'completed' | 'failed';
 export type VulnScanTrigger = 'manual' | 'scheduled' | 'deploy' | 'deploy-preflight';
 
+export type PolicyBlockReason = 'severity' | 'kev' | 'fixable';
+
 export interface ScanPolicyEvaluation {
   policyId: number;
   policyName: string;
   maxSeverity: VulnSeverity;
+  // Inputs that matched (severity / kev / fixable). Empty for evaluations
+  // persisted before reason tracking; the banner falls back to a plain
+  // violation notice in that case.
+  reasons: PolicyBlockReason[];
   violated: boolean;
 }