Split the vulnerability view into host and container categories

The findings of the Debian host (OS packages and applications found in the
root filesystem) and of the container images in the cluster were mixed in
one flat table. They are now two prominent categories: a card each with its
own severity split and target count, acting as the primary selector, and a
table that adapts to the selection. Host findings show the package source
reported by the scanner (debian, gobinary, node-pkg …) instead of the
target, container findings show the image.

Backend: findings carry the scanner's package source, the list endpoint
takes ?scope=host|container, and the targets endpoint reports each target
with its category and open count.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/crates/application/src/test_fakes.rs

@@ -525,6 +525,7 @@ pub fn raw(
         fixed_version: fixed.map(String::from),
         title: format!("{cve} in {pkg}"),
         url: format!("https://nvd.nist.gov/vuln/detail/{cve}"),
+        source: "debian".into(),
     }
 }
 
@@ -627,6 +628,7 @@ impl FindingRepository for MemFindings {
             .iter()
             .filter(|f| filter.include_fixed || f.status != FindingStatus::Fixed)
             .filter(|f| filter.min_severity.is_none_or(|m| f.raw.severity >= m))
+            .filter(|f| filter.target_kind.is_none_or(|k| f.target_kind == k))
             .filter(|f| filter.target.as_ref().is_none_or(|t| &f.target == t))
             .filter(|f| filter.status.is_none_or(|s| f.status == s))
             .cloned()

backend/crates/application/src/vuln_service.rs

@@ -27,6 +27,19 @@ pub struct VulnerabilityService {
 pub const KEY_NOTIFY_MIN_SEVERITY: &str = "vuln.notify_min_severity";
 pub const DEFAULT_NOTIFY_MIN_SEVERITY: Severity = Severity::High;
 
+/// One scanned target with its number of open findings.
+#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize)]
+pub struct TargetSummary {
+    #[serde(serialize_with = "serialize_kind")]
+    pub kind: TargetKind,
+    pub target: String,
+    pub open: usize,
+}
+
+fn serialize_kind<S: serde::Serializer>(k: &TargetKind, s: S) -> Result<S::Ok, S::Error> {
+    s.serialize_str(k.as_str())
+}
+
 #[derive(Clone, Debug, Default, PartialEq, Eq, serde::Serialize)]
 pub struct Summary {
     pub total: SeverityCounts,
@@ -221,17 +234,21 @@ impl VulnerabilityService {
         self.findings.list(&filter).await
     }
 
-    pub async fn targets(&self) -> Result<Vec<String>, DomainError> {
-        let mut t: Vec<String> = self
-            .findings
-            .list(&FindingFilter::default())
-            .await?
+    /// Scanned targets that still have open findings, host first.
+    pub async fn targets(&self) -> Result<Vec<TargetSummary>, DomainError> {
+        let mut by_target: std::collections::HashMap<(TargetKind, String), usize> =
+            Default::default();
+        for f in self.findings.list(&FindingFilter::default()).await? {
+            *by_target.entry((f.target_kind, f.target)).or_default() += 1;
+        }
+        let mut targets: Vec<TargetSummary> = by_target
             .into_iter()
-            .map(|f| f.target)
+            .map(|((kind, target), open)| TargetSummary { kind, target, open })
             .collect();
-        t.sort();
-        t.dedup();
-        Ok(t)
+        targets.sort_by(|a, b| {
+            (a.kind != TargetKind::Os, &a.target).cmp(&(b.kind != TargetKind::Os, &b.target))
+        });
+        Ok(targets)
     }
 
     pub async fn summary(&self) -> Result<Summary, DomainError> {