feat(nav): surface the four Exposures pages that have real data

[0xmanhnv]

/exposures/{vulnerabilities,secrets,code,misconfigurations} are 1,393 lines of
finished, working screens with no route into them.

Each is scoped to its own finding type — this is what separates them from the
scaffolds around them:

useFindingTypeStats(tenantId, ['secret'])
useFindingTypeStats(tenantId, ['sast'])
useFindingTypeStats(tenantId, ['iac'])
useFindingTypeStats(tenantId, VULNERABILITY_SOURCES)

Shape

Exposures becomes a collapsible. NavCollapsible carries no url in
src/components/types.ts, so the parent page is reached through an Overview
child — the same shape Integrations already uses a few hundred lines down in the
same file.

What is deliberately absent

/exposures/credentials. It reads useDashboardStats and renders every
finding in the tenant under a "Credential Exposures" heading.

Wiring it would put a chart labelled as credentials in front of users showing
unrelated numbers — in a security product that is worse than no page, because it
will be read as fact. It is also the same defect ui#339 just removed: a nav
entry that looks shipped and is not.

That distinction is the entire reason this PR is four pages and not eleven. An
earlier draft of docs/nav-coverage.md called eleven of these "easy wins, all
data-wired". Checking what they actually render showed seven were scaffolds
driven by dashboard totals — /controls/* derives "controls" from
stats.assets.byType. See ui#341 for the classification of all 107 pages
outside the sidebar.

Effect

Sidebar coverage: 64 → 68 of 171 static pages.

Verification

tsc --noEmit clean, eslint clean, prettier-formatted, and the palette-drift
gate from ui#340 passes on this branch.