feat: vulnerability scanning pipeline, matcher, scheduler and API

Completes tasks 10-15 and fixes what was outstanding:

- vulndb.Pull implemented with oras-go, streaming the ~50MB layer and
  staging both files before replacing either, so a failed pull leaves the
  previous database intact rather than a half-written one.
- db.go: Vulnerability.Severity is a string, not trivy Severity, so the
  int conversion did not compile. Severity now resolves vendor (highest
  when vendors disagree) then NVD then unknown, and CVSS is read too.
- findings.go: added sweepFixedFindings plus the fleet query, severity
  counts, rescan flag and accept/unaccept the API needs.
- vulnrules.go: added rule CRUD and the digest builder. ResolveTargets
  returns []models.Server, not []string, so filterByServers was wrong.
- api/vulnerabilities.go was an empty file while handlers.go registered
  twelve routes against it; written, grouped by CVE.
- shared/mail: added the missing sender. The templates were orphaned and
  the HTML one was a copy of the text one, defining "subject" (which
  html/template would escape) and emitting no markup. render.go parses
  every template in init(), so a bad one panics server, admin and sitesvc
  at boot — go build never runs init(), which is why nothing complained.
- notify: digests dispatch through their own path so SMTP gets the digest
  template rather than arriving dressed as a monitor alert.

shared/mail/templates/vuln_digest.html.tmpl

@@ -0,0 +1,13 @@
+{{define "title"}}New vulnerabilities detected{{end}}
+{{define "pill"}}{{template "chip" (dict "label" (upper .TopSeverity) "tone" "down")}}{{end}}
+{{define "body"}}
+{{template "lead" .Summary}}
+{{template "rows" (list
+  (dict "k" "Instance" "v" .InstanceName)
+  (dict "k" "New findings" "v" .Count))}}
+{{range .Rows}}
+{{if .FixedIn}}{{template "well" (printf "%s (%s) — %s on %s, fixed in %s" .CVEID .Severity .PackageName .ServerName .FixedIn)}}{{else}}{{template "well" (printf "%s (%s) — %s on %s, no fix published" .CVEID .Severity .PackageName .ServerName)}}{{end}}
+{{end}}
+{{if .More}}{{template "p" (printf "…and %d more." .More)}}{{end}}
+{{template "note" (printf "Scanned against a vulnerability database pulled %s ago." .DBAge)}}
+{{end}}

shared/mail/templates/vuln_digest.txt.tmpl

@@ -0,0 +1,12 @@
+{{define "subject"}}{{.Count}} new {{if eq .Count 1}}vulnerability{{else}}vulnerabilities{{end}} on {{.InstanceName}}{{end}}
+{{define "title"}}New vulnerabilities detected{{end}}
+{{define "pill"}}{{.TopSeverity}}{{end}}
+{{define "body"}}
+{{template "lead" .Summary}}
+
+{{range .Rows}}- {{.CVEID}} ({{.Severity}}) — {{.PackageName}} on {{.ServerName}}{{if .FixedIn}}, fixed in {{.FixedIn}}{{else}}, no fix published{{end}}
+{{end}}
+{{if .More}}...and {{.More}} more.{{end}}
+
+Scanned against vulnerability database pulled {{.DBAge}} ago.
+{{end}}