Trivy: scan images from the local containerd store before the registry

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

backend/crates/api/src/config.rs

@@ -13,6 +13,8 @@ pub struct Config {
     pub kubeconfig: Option<String>,
     /// kubectl invocation for backups, e.g. ["/snap/bin/microk8s", "kubectl"].
     pub kubectl: Vec<String>,
+    /// containerd socket for local image scans (default: microk8s socket if present).
+    pub containerd_socket: Option<String>,
     /// Scratch directory for backup archives.
     pub work_dir: std::path::PathBuf,
     pub bind: SocketAddr,
@@ -47,6 +49,12 @@ impl Config {
                         vec!["kubectl".into()]
                     }
                 }),
+            containerd_socket: env("CONTAINERD_ADDRESS").or_else(|| {
+                let microk8s = "/var/snap/microk8s/common/run/containerd.sock";
+                std::path::Path::new(microk8s)
+                    .exists()
+                    .then(|| microk8s.to_string())
+            }),
             work_dir: env("WORK_DIR")
                 .map(Into::into)
                 .unwrap_or_else(|| "data/work".into()),