feat(web): store immutable reports and serve normalized downloads

[back1ash]

Summary

Persist write-once scan attempts and expose pending or terminal report data plus normalized JSON downloads.

Scope

• Store attempt metadata, normalized result, report projection, and artifact identities.
• Serve stable run URLs for pending, success, advisory, failure, and error states.
• Provide normalized result JSON and an exact local reproduction command.
• Prevent presentation data from mutating the normalized result.
• Use repository and installation numeric identity in access decisions.

Acceptance criteria

• Terminal report content is immutable for one attempt.
• Downloaded JSON matches the stored normalized result digest.
• Pending reports transition without changing the run URL.
• Unknown or incomplete attempts fail visibly rather than appearing successful.
• Storage and API responses do not expose credentials or host-specific paths.

Dependencies

• docs(security): define the initial threat model #8
• feat(infra): build the durable queue and isolated scan worker #34
• feat(core): assemble normalized runs, fingerprints, and gate outcomes #24

Priority gate and claiming

Keep status:blocked until every open priority:p1 issue is closed,
the Phase 0 hosted-product decision is proceed, and every explicit
dependency above is closed. Only then replace it with status:ready
and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• Private repository support, report comparison, or line annotations.
• Editing or deleting normalized findings in place.