feat: attack chain correlation + Trivy scanning + impact diagram (closes #25, #28, #31)

[CodeBuildder]

Summary

Attack chain correlation (closes #25)

• 30-minute sliding window correlates alerts by namespace+node
• MITRE kill chain stage mapping for 15+ Falco rules
• Confidence scoring: 1 stage=35%, 2=60%, 3+=80%
• GET /attack-chains endpoint
• Auto-triggers from audit logger on every incident

Trivy image scanning (closes #28)

• VulnerabilityReport CRD fetcher in enricher.py
• Kyverno policy blocks CRITICAL CVEs in prod
• CVE data flows into Claude reasoning prompt
• trivy source added to enrichment_sources

Impact diagram UI (closes #31)

• Live cluster topology: all 3 nodes with IPs
• Pod status: threat/risk/safe/isolated per node
• Animated scan line continuously sweeps the diagram
• Risk bars animate on incident selection: data exposure, lateral movement, node compromise
• Node status derived from incident severity and hostname
• What happened bullets + numbered action steps

Checks

• git diff --check passed
• No system, kubectl, docker, test, or build commands run per instruction; only git and gh CLI commands were used

Closes #25, #28, #31