feat(security): one-click managed Trivy install (#643)

* feat(security): one-click managed Trivy install

Add a Vulnerability Scanner card to Settings, Security with install,
update, uninstall, and auto-update controls (Admiral-only). The installer
downloads a verified Trivy release into the existing data volume at
/app/data/bin/trivy and defaults the cache to /app/data/trivy-cache, so
no host mounts or extra env vars are required. Detection probes the
managed path, a TRIVY_BIN override, and the host PATH, distinguishing
managed vs host installs. A daily scheduled check surfaces available
Trivy updates, installs them automatically when opted in, and dedupes
notifications per version.

* fix(frontend): silence react-hooks/set-state-in-effect in useTrivyStatus

The initial status fetch and managed-source update check both call
setState from the effect body. Match the existing pattern used in
useDashboardData / SSOSection and disable the rule at the call site.

frontend/src/components/ResourcesView.tsx

@@ -465,7 +465,7 @@ export default function ResourcesView() {
     const [bulkPurgeConfirm, setBulkPurgeConfirm] = useState(false);
 
     // Vulnerability scanning state
-    const trivy = useTrivyStatus();
+    const { status: trivy } = useTrivyStatus();
     const [scanSummaries, setScanSummaries] = useState<Record<string, ScanSummary>>({});
     const [scanningImageRef, setScanningImageRef] = useState<string | null>(null);
     const [inspectScanId, setInspectScanId] = useState<number | null>(null);