feat(reports): scope the executive report by group + framework (A1)

[remyluslosius]

First implementation slice of the Reports build-out (docs/engineering/reports_design.md §11, Phase A1). Makes the executive report scopable instead of all-hosts-only.

What

POST /api/v1/reports:generate now accepts an optional scope {group_id?, framework?}. An empty body keeps the exact v1.0.0 all-hosts behavior.

• group_id scopes the posture to a group's member hosts via a new group.Service.ScopeGroup (reuses memberCTE: manual → group_members, auto → hosts.os_family == match_family). host_count and every rule count reflect only those hosts. Unknown group → group.ErrNotFound → 400 reports.invalid_scope; an empty group reads as zero hosts (distinct from unscoped).
• framework applies the fleet-rollup lens (framework_refs ? key), counting only rules in that framework.
• The resolved scope (group_id, group name frozen at generation time, framework) is stored on a new reports.scope JSONB (migration 0041) and echoed on the wire. scope_label is derived: Production · CIS, All hosts · STIG, Production, All hosts.

Frontend

A group scope picker beside Generate (a <select> sourced from GET /api/v1/groups, default "All hosts"), host:write-gated. scope_label already flows to the Library + detail rows, so the chosen scope shows up automatically.

Deliberate cut: the framework-lens picker UI is deferred until a fleet framework catalog endpoint exists (there's only a per-host one today). The backend, API contract, spec, and tests already fully support framework — so it's forward-compatible, just not yet exposed in the UI. Noted for a fast-follow.

SDD

• api-reports v1.1.0 — C-07 + AC-07 (label derivation, unit), AC-08 (group scope, DB), AC-09 (framework scope, DB).
• frontend-reports v1.1.0 — C-04 + AC-05 (scope picker source inspection).

Validation

• gofmt/go vet/go build clean.
• specter check 111/111 structural; api-reports 9/9, frontend-reports 5/5, 100%; specter check --test 0 errors.
• report + group Go suites green (isolated PG); reports vitest 5/5; full frontend suite 323/323.

Net: no new data collection — reports still derive from host_rule_state + groups, so the numbers stay consistent with the Groups page.