feat: vulnerability findings UI

Fleet board grouped by CVE, a per-server section on server detail, and
alert rules beside the channels they consume.

The server detail page has no tab pattern despite the plan saying to
follow one, so this adds a section in the existing vertical stack.

Three states are kept visually distinct because they are identical if
handled carelessly and only one is good news: never reported, no advisory
feed for the distribution, and scanned-and-clean. Database freshness sits
with the findings rather than in settings for the same reason.

web/components/Sidebar.tsx

@@ -121,9 +121,22 @@ function StepsIcon() {
     );
 }
 
+function ShieldIcon() {
+    return (
+        <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={1.5}>
+            <path
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                d="M11.998 2.25a.75.75 0 01.298.062l7.5 3.214a.75.75 0 01.454.69v5.034c0 4.63-2.94 8.75-7.5 10.25a.75.75 0 01-.5 0c-4.56-1.5-7.5-5.62-7.5-10.25V6.216a.75.75 0 01.454-.69l7.5-3.214a.75.75 0 01.294-.062zM12 8.25v3.75m0 3h.008v.008H12v-.008z"
+            />
+        </svg>
+    );
+}
+
 const navItems: NavItem[] = [
     { href: "/servers", label: "Servers", icon: <ServerIcon /> },
     { href: "/monitors", label: "Monitors", icon: <MonitorIcon /> },
+    { href: "/vulnerabilities", label: "Vulnerabilities", icon: <ShieldIcon /> },
     { href: "/keys", label: "SSH Keys", icon: <KeyIcon /> },
     { href: "/secrets", label: "Secrets", icon: <SecretIcon /> },
     { href: "/workflows", label: "Workflows", icon: <WorkflowIcon /> },