fix(security): clear cached policy evaluations when a scan policy is deleted (#758)

Vulnerability scans cache their policy verdict as a JSON blob in
vulnerability_scans.policy_evaluation. Deleting a scan policy used to
remove only the policies row and leave those blobs intact, so the
scheduler kept emitting violations and stacks remained marked as blocked
against a policy that no longer existed.

deleteScanPolicy now nulls out policy_evaluation on every scan whose
JSON references the deleted policy id, then deletes the policy row, in
one transaction.

backend/src/services/DatabaseService.ts

@@ -3015,7 +3015,20 @@ export class DatabaseService {
     }
 
     public deleteScanPolicy(id: number): void {
-        this.db.prepare('DELETE FROM scan_policies WHERE id = ?').run(id);
+        // policy_evaluation is a JSON blob containing the policyId of the policy
+        // that produced it. Clear it on every scan referencing the deleted policy
+        // so cached scans no longer report stale violations after the policy is gone.
+        const clearEval = this.db.prepare(
+            `UPDATE vulnerability_scans
+                SET policy_evaluation = NULL
+              WHERE json_extract(policy_evaluation, '$.policyId') = ?`,
+        );
+        const deletePolicy = this.db.prepare('DELETE FROM scan_policies WHERE id = ?');
+        const txn = this.db.transaction((policyId: number) => {
+            clearEval.run(policyId);
+            deletePolicy.run(policyId);
+        });
+        txn(id);
     }
 
     /**