feat: pre-deploy scan visibility and pinned scanner version (#1378)

* feat: pre-deploy scan visibility and pinned scanner version

Pin managed Trivy installs and add an opt-in pre-deploy scan advisory so a
manual deploy can surface each image's latest scan before it runs.

- Managed Trivy now installs a pinned, known-good version by default for
  reproducible installs. Auto-update still tracks the latest release, and an
  explicit update always pulls the latest.
- Add an opt-in pre-deploy scan advisory: when enabled, deploying a stack from
  the editor first shows each image's latest cached scan severity for review.
  It is visibility only and never blocks; deploy enforcement is unchanged.
- Backend: pre_deploy_scan_advisory setting, PUT
  /security/pre-deploy-scan-advisory, a cache-only GET
  /security/stacks/:name/pre-deploy-summary, and a node-scoped
  getLatestVulnScanByDigestForNode lookup.
- Frontend: advisory toggle on the Security page scanner setup, and a
  PreDeployScanDialog wired into the editor deploy flow that fails open when the
  summary is unavailable.
- Docs: scanner configuration, version pinning, and the advisory.

* fix: harden pre-deploy advisory guard, toggle visibility, and installer busy state

Addresses review findings on the pre-deploy advisory.

- Block a second editor deploy during the async advisory window with a
  synchronous pending ref, cleared on cancel and in the deploy's finally, so a
  double-click can no longer start two deploys.
- Keep the pre-deploy advisory toggle visible to admins whenever the setting is
  on, so it can still be turned off after the scanner becomes unavailable.
- Resolve the managed Trivy version inside the install lock so the busy state and
  serialization cover the latest-version fetch and the managed-install check.

frontend/src/components/stack/__tests__/PreDeployScanDialog.test.tsx

@@ -0,0 +1,49 @@
+import { describe, it, expect, vi } from 'vitest';
+import { render, screen, fireEvent } from '@testing-library/react';
+import { PreDeployScanDialog } from '../PreDeployScanDialog';
+import type { PreDeployScanImage } from '@/types/security';
+
+const images: PreDeployScanImage[] = [
+  {
+    imageRef: 'nginx:1.14',
+    scan: {
+      criticalCount: 31,
+      highCount: 82,
+      mediumCount: 1,
+      lowCount: 4,
+      highestSeverity: 'CRITICAL',
+      scannedAt: Date.now() - 3_600_000,
+    },
+  },
+  { imageRef: 'redis:7', scan: null },
+];
+
+describe('PreDeployScanDialog', () => {
+  it('renders each image with its scan counts or a not-scanned note', () => {
+    render(
+      <PreDeployScanDialog open stackName="web" images={images} onCancel={vi.fn()} onDeploy={vi.fn()} />,
+    );
+    expect(screen.getByText('nginx:1.14')).toBeInTheDocument();
+    expect(screen.getByText(/31 critical/)).toBeInTheDocument();
+    expect(screen.getByText('redis:7')).toBeInTheDocument();
+    expect(screen.getByText('not scanned')).toBeInTheDocument();
+  });
+
+  it('calls onDeploy when Deploy is clicked', () => {
+    const onDeploy = vi.fn();
+    render(
+      <PreDeployScanDialog open stackName="web" images={images} onCancel={vi.fn()} onDeploy={onDeploy} />,
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Deploy' }));
+    expect(onDeploy).toHaveBeenCalledTimes(1);
+  });
+
+  it('calls onCancel when Cancel is clicked', () => {
+    const onCancel = vi.fn();
+    render(
+      <PreDeployScanDialog open stackName="web" images={images} onCancel={onCancel} onDeploy={vi.fn()} />,
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }));
+    expect(onCancel).toHaveBeenCalledTimes(1);
+  });
+});