feat(fleet): replicate scan policies across managed nodes (#649)

Scan policies now propagate from the control Sencho instance to every
registered remote. The control is the source of truth; replicas render
rules read-only with a managed-by-control banner. Pushes fire on every
policy write, record per-node success and failure on a new
fleet_sync_status table, and use node_proxy Bearer tokens exclusively
so only sibling Senchos can apply incoming sync payloads. Policy scope
now travels as a string identity (api_url or a local sentinel) so
node-scoped rules evaluate correctly on each target.

frontend/src/types/security.ts

@@ -73,14 +73,18 @@ export interface ScanPolicy {
   id: number;
   name: string;
   node_id: number | null;
+  node_identity: string;
   stack_pattern: string | null;
   max_severity: VulnSeverity;
   block_on_deploy: number;
   enabled: number;
+  replicated_from_control: number;
   created_at: number;
   updated_at: number;
 }
 
+export type FleetRole = 'control' | 'replica';
+
 export interface ScanCompareVulnerability {
   vulnerability_id: string;
   pkg_name: string;