feat(security): secret and misconfiguration scanning (#651)

Extends Trivy scans with secret detection in image filesystems and
misconfiguration scanning for Compose stacks. Adds tabs to the scan
drawer for vulnerabilities, secrets, and misconfigs. Secret matches
are redacted server-side (first 8 chars + ellipsis) before storage.

- TrivyService: --scanners vuln,secret for images; trivy config for stacks
- DB: scanners_used/secret_count/misconfig_count cols; secret_findings,
  misconfig_findings tables; cache key scoped by scanners
- Routes: POST /security/scan accepts scanners array (requirePaid when
  secret requested); POST /security/scan/stack; GET .../secrets and
  .../misconfigs (paid-tier reads)
- UI: tabs in VulnerabilityScanSheet; scan-options dropdown on images;
  Scan config button on stack header

frontend/src/types/security.ts

@@ -32,6 +32,9 @@ export interface VulnerabilityScan {
   low_count: number;
   unknown_count: number;
   fixable_count: number;
+  secret_count: number;
+  misconfig_count: number;
+  scanners_used: string;
   highest_severity: VulnSeverity | null;
   os_info: string | null;
   trivy_version: string | null;
@@ -42,6 +45,32 @@ export interface VulnerabilityScan {
   stack_context: string | null;
 }
 
+export interface SecretFinding {
+  id: number;
+  scan_id: number;
+  rule_id: string;
+  category: string | null;
+  severity: VulnSeverity;
+  title: string | null;
+  target: string;
+  start_line: number | null;
+  end_line: number | null;
+  match_excerpt: string | null;
+}
+
+export interface MisconfigFinding {
+  id: number;
+  scan_id: number;
+  rule_id: string;
+  check_id: string | null;
+  severity: VulnSeverity;
+  title: string | null;
+  message: string | null;
+  resolution: string | null;
+  target: string;
+  primary_url: string | null;
+}
+
 export interface VulnerabilityDetail {
   id: number;
   scan_id: number;