Implement Trivy adapter, contain job panics, fail interrupted runs on startup

The Trivy scanner still had unimplemented stubs, which panicked the scan
task in the deployed test instance and left the run in 'running' forever.
JobRunner now runs handlers in their own task and marks a panic as a
failed run; on startup runs left 'running' by a previous process are
marked failed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/domain/src/ports.rs

@@ -78,6 +78,8 @@ pub trait JobRunRepository: Send + Sync {
     async fn list(&self, limit: u32) -> Result<Vec<JobRun>, DomainError>;
     async fn find_running(&self, kind: JobKind) -> Result<Option<JobRun>, DomainError>;
     async fn last_finished(&self, kind: JobKind) -> Result<Option<JobRun>, DomainError>;
+    /// All runs still marked running (e.g. after a crash).
+    async fn running(&self) -> Result<Vec<JobRun>, DomainError>;
 }
 
 /// Reads the state of the Debian host.