Roll findings up per package and image, expandable to their CVEs

The findings table listed every CVE, which is thousands of rows on a real
host. It now shows one row per affected package (host) or image
(containers) with its severity split, how many findings it has and how
many of them have a fix. Clicking a row loads and shows the CVEs of that
group; collapsing keeps them cached.

The rollup is a GROUP BY in SQLite behind a new groups endpoint, so the
page loads a few dozen rows instead of the full finding list, and the
flat list gained a package filter to expand one group.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/e2e/vuln-groups.spec.ts

@@ -15,7 +15,7 @@ test('packages and images are one row each and expand to their CVEs', async ({ p
   await scan(page)
 
   // host: a row per package, no CVE ids until a row is opened
-  const zlib = page.getByRole('row', { name: /^zlib1g/ })
+  const zlib = page.getByRole('row', { name: /zlib1g/ })
   await expect(zlib).toBeVisible()
   await expect(page.getByRole('row', { name: /CVE-2023-45853/ })).toHaveCount(0)