feat(reports): Remediation Activity kind (Phase C2)

[remyluslosius]

Summary

Phase C2 adds the remediation report kind — an Operations read-model of remediation requests over a look-back window, the second Phase C delivery-spine kind.

What it does

• Migration 0045 admits kind='remediation'.
• The generate request gains period_days (1..365, default 30, clamped). Generate(kind=remediation) resolves [now - period_days, now] and freezes a RemediationContent {period_from, period_to, summary, activities[]} over remediation_requests filtered on requested_at, scoped to the in-scope hosts:
  • summary is an exact aggregate by outcome (total / executed / rolled_back / failed / rejected / pending).
  • activities[] is one capped row per request (host, rule, status, mechanism, requester + reviewer usernames, requested/reviewed timestamps).
• Faces: CSV is the full activity log (csvSafe-guarded), PDF is the bounded one-page summary (counts + recent sample), JSON is the signed canonical content. pdf/csv kind-dispatched; oscal_sar invalid for the kind.
• Frontend: the kind selector gains Remediation Activity; a Last 7 / 30 / 90 days period selector appears for that kind and drives period_days; a kind-aware RemediationBody renders the period + outcome summary + recent-activity table; CSV-led with a PDF-summary secondary.

Spec / tests

• api-reports v1.13.0 (C-18 / AC-24 — Go DB test over a 5-request window fixture; verifies the out-of-window request is excluded and the ~30-day period).
• frontend-reports v1.10.0 (C-13 / AC-14 — source-inspection over the selector, period control, and RemediationBody).
• gofmt/vet/build clean; go test ./internal/report/ green; tsc/eslint/prettier clean; full vitest 336 passed; specter check 112 specs + structural coverage 100%.

Phase C sequencing

This is C2. The remaining slice is C3 — Scheduled dispatcher + email delivery, the product-design-heavy one I'll scope with you before building (recurrence semantics, delivery channels).

Validation

• gofmt / vet / build / go test
• tsc / eslint / prettier / vitest (336)
• specter check + structural coverage (100%)