feat(web): implement public report UX and lifecycle controls

[back1ash]

Summary

Provide a public-repository report experience with finding filters, details, explicit visibility, retention, and tombstoning behavior.

Scope

• Render pending, pass, advisory, blocked, input-error, and internal-error states.
• Filter findings by severity, rule, risk, and operation.
• Show evidence, source location, remediation, provenance, and reproduction details.
• Revalidate current repository visibility and installation access before serving.
• Tombstone and purge cached reports after privatization, uninstall, transfer, or deletion.

Acceptance criteria

• Every normalized state has a tested accessible presentation.
• Report filters do not alter the downloadable normalized result.
• Public visibility is explicit and fail-closed when current status cannot be verified.
• Renames and transfers cannot expose a different repository report.
• Lifecycle events produce the documented tombstone and retention behavior.

Dependencies

• docs(security): define the initial threat model #8
• feat(web): store immutable reports and serve normalized downloads #38

Priority gate and claiming

Keep status:blocked until every open priority:p1 issue is closed,
the Phase 0 hosted-product decision is proceed, and every explicit
dependency above is closed. Only then replace it with status:ready
and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• Private repository authorization, billing, report comparison, or custom branding.
• Client-side interpretation of untrusted HTML from specifications.