feat(images): Trivy-powered vulnerability scanning (#635)

* feat(images): Trivy-powered vulnerability scanning

Scan container images for known CVEs via Trivy. On-demand scanning and
severity badges are available on every tier; scheduled scans, scan
policies, SBOM generation, and scan history are gated to Skipper+.

- New TrivyService (binary detection, per-image scan, SBOM, digest cache)
- Three new tables: vulnerability_scans, vulnerability_details, scan_policies
- 12 routes under /api/security (scan, results, summaries, SBOM, policies, compare)
- Post-deploy async scans wired into all five deploy paths, with a
  per-deploy opt-out toggle in the App Store deploy sheet
- "scan" action type added to SchedulerService for fleet-wide recurring scans
- Frontend: severity badges in Resources Hub with animated cursor detail,
  scan results drawer with vulnerability table and filters, and a new
  Security section in Settings for scan policy CRUD
- Policy threshold violations dispatch a warning or critical alert based on
  the policy's block_on_deploy flag; deploys themselves are never blocked

* fix(security): compute scan age in useEffect to satisfy react-hooks/purity

docs/docs.json

@@ -115,6 +115,7 @@
               "features/audit-log",
               "features/api-tokens",
               "features/private-registries",
+              "features/vulnerability-scanning",
               "features/auto-update-policies",
               "features/scheduled-operations",
               "features/sso",
@@ -140,6 +141,7 @@
               "operations/backup",
               "operations/upgrade",
               "operations/self-hosting",
+              "operations/trivy-setup",
               "operations/two-factor-admin"
             ]
           }