WP-20/21: vulnerability management with Trivy and mail notifications

Trivy scanner adapter (rootfs + image JSON, parsed and deduplicated),
findings repository, scan diff that keeps first_seen, marks disappeared
findings fixed and skips failed targets, vulnerability_scan job (daily by
default), digest mail for new findings at or above a configurable severity,
/api/vulnerabilities routes, Vulnerabilities page with severity tiles,
filters, details and acknowledge, notification threshold in settings.
Deploy script installs Trivy from the Aqua apt repository.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/api/src/openapi.rs

@@ -28,6 +28,8 @@ impl Modify for BearerAuth {
         crate::jobs::list, crate::jobs::kinds, crate::jobs::get_one, crate::jobs::run,
         crate::system::inventory, crate::system::upgrade,
         crate::cluster::overview, crate::cluster::restart, crate::cluster::scale, crate::cluster::set_image,
+        crate::vulnerabilities::list, crate::vulnerabilities::summary, crate::vulnerabilities::targets, crate::vulnerabilities::set_status,
+        crate::settings::get_notifications, crate::settings::put_notifications,
     ),
     modifiers(&BearerAuth)
 )]