refactor(backend): hoist severity Sets to utils/severity.ts (#795)

Replaces five inline new Set([...]) literals scattered across
routes/security.ts and routes/fleet.ts with two shared constants
(FINDING_SEVERITIES, POLICY_SEVERITIES) exported from
utils/severity.ts. Pure refactor: no error response or status code
changes.

Closes #749

backend/src/utils/severity.ts

@@ -8,6 +8,21 @@ export const SEVERITY_ORDER: VulnSeverity[] = [
     'CRITICAL',
 ];
 
+export const FINDING_SEVERITIES: ReadonlySet<string> = new Set<VulnSeverity>([
+    'CRITICAL',
+    'HIGH',
+    'MEDIUM',
+    'LOW',
+    'UNKNOWN',
+]);
+
+export const POLICY_SEVERITIES: ReadonlySet<string> = new Set<VulnSeverity>([
+    'CRITICAL',
+    'HIGH',
+    'MEDIUM',
+    'LOW',
+]);
+
 export function severityRank(severity: VulnSeverity | null | undefined): number {
     if (!severity) return -1;
     return SEVERITY_ORDER.indexOf(severity);