style: bring the vulnerabilities page onto the house page shape

Every other page under app/(app) opens with `p-4 sm:p-6 lg:p-8` and the
layout adds none of its own, so this page alone sat flush against the shell
edge. Its h1 was text-xl where every other page is text-2xl.

The findings list was a stack of separately bordered cards; it is now rows
inside one Card, separated by border-border-soft, matching the monitors and
workflows lists. Loading is the shared spinner rather than a line of text,
the error is the shared danger strip, and the empty state uses the same
proportions as the monitors one.

web/components/vulnerabilities/FindingRow.tsx

@@ -32,26 +32,32 @@ export function FindingRow({ group, serverName, canAct, onAccept, onUnaccept, on
     const anyFix = group.findings.some((f) => f.fixed_in);
 
     return (
-        <div className="rounded-lg border border-border bg-surface">
+        // A row inside the page's one bordered container, not a card of its
+        // own — the same stack idiom as the monitors and workflows lists.
+        <div className="border-t border-border-soft first:border-t-0">
             <button
                 onClick={() => setOpen((v) => !v)}
-                className="flex w-full items-center gap-3 px-4 py-3 text-left hover:bg-surface-2"
+                className="flex w-full items-center gap-3 px-4 py-3.5 text-left transition-colors hover:bg-surface-2 focus:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-accent sm:px-5"
                 aria-expanded={open}
             >
                 <span className="font-mono text-xs text-text-tertiary">{open ? "▾" : "▸"}</span>
                 <SeverityBadge severity={group.severity} />
                 <span className="font-mono text-sm font-medium text-text-primary">{group.cve_id}</span>
                 {group.title && <span className="hidden truncate text-sm text-text-secondary sm:block">{group.title}</span>}
-                <span className="ml-auto whitespace-nowrap text-xs text-text-secondary">
+                <span className="ml-auto whitespace-nowrap font-mono text-[11px] text-text-tertiary">
                     {group.server_count} {group.server_count === 1 ? "server" : "servers"}
                 </span>
-                {!anyFix && <span className="whitespace-nowrap text-xs text-text-tertiary">no fix published</span>}
+                {!anyFix && (
+                    <span className="hidden whitespace-nowrap rounded-sm border border-border px-1.5 font-mono text-[10px] uppercase tracking-[0.1em] text-text-tertiary sm:block">
+                        no fix
+                    </span>
+                )}
             </button>
 
             {open && (
-                <div className="border-t border-border">
+                <div className="border-t border-border-soft bg-surface-2/40">
                     {group.findings.map((f) => (
-                        <div key={f.id} className="flex flex-wrap items-center gap-x-4 gap-y-2 border-b border-border-soft px-4 py-3 last:border-b-0">
+                        <div key={f.id} className="flex flex-wrap items-center gap-x-4 gap-y-2 border-b border-border-soft px-4 py-3 last:border-b-0 sm:px-5">
                             <Link href={`/servers/${f.server_id}`} className="text-sm text-accent hover:underline">
                                 {serverName(f.server_id)}
                             </Link>