feat(security): scan comparison UI (#648)

Side-by-side vulnerability scan comparison with two entry points:

- Compare button plus inline baseline picker inside the scan drawer.
- New Scan History page reachable from the Resources Hub, grouping
  completed scans by image with a checkbox selection flow.

The comparison sheet shows a severity delta ribbon, Added/Removed/Unchanged
filters, and a paginated CVE table. Cross-image comparisons are allowed
but flagged with a warning. Compare access is gated to Skipper and
Admiral tiers; the underlying /security/compare endpoint is unchanged.

docs/features/vulnerability-scanning.mdx

@@ -170,6 +170,24 @@ Every scan Sencho runs is stored with its full vulnerability detail. Scan record
 - **Digest caching**: skip re-scanning an image that has already been scanned within 24 hours.
 - **Trend badges**: surface whether the latest scan added or resolved vulnerabilities compared to the previous scan for the same image.
 
+Open the **Scan history** page from the top of the Resources Hub to browse completed scans grouped by image, search by image reference, and pick two scans to compare.
+
+## Comparing scans <Badge>Skipper</Badge>
+
+Compare any two completed scans for an image to see what changed between them.
+
+**From the Scan history page**: select two scans via the checkboxes (one baseline, one newer) and click **Compare**. Selecting a third scan replaces the oldest selection.
+
+**From an open scan**: click **Compare** in the drawer header, then pick a baseline scan from the dropdown. Only completed scans for the same image appear.
+
+The comparison sheet shows:
+
+- A **delta ribbon** summarizing the net change per severity (CRITICAL, HIGH, MEDIUM, LOW).
+- Filter pills to switch between **Added** (new findings since the baseline), **Removed** (resolved findings), and **Unchanged** (findings present in both).
+- A sorted table of CVEs with severity, affected package, and direct links to Trivy's primary URL when available.
+
+Cross-image comparisons (picking scans from two different image references) are allowed but flagged with a warning, since package-level changes may reflect image differences rather than CVE drift.
+
 ## How it works
 
 1. On startup, Sencho looks for the `trivy` binary on `PATH` and caches its availability.
@@ -211,3 +229,7 @@ Enable **Developer Mode** under **Settings → Developer** and trigger the faili
 ### Post-deploy scan failure notifications
 
 When a post-deploy scan fails for a specific image (for example because Trivy could not resolve a private registry pull), Sencho dispatches a warning-level alert through your configured notification channels. The deploy itself is never blocked by a scan failure.
+
+### Compare button is disabled
+
+Two completed scans are required to run a comparison. If you have only one scan for an image, trigger a second scan from the Resources Hub (or wait for a scheduled scan), then return to the Scan history page and tick both.