feat: Added vuln filter

server/internal/services/findings.go

@@ -112,6 +112,10 @@ type FindingFilter struct {
 	State    string
 	ServerID string
 	Tags     map[string]string
+	// HasFix nil is no filter. true is "a vendor fix exists, this is
+	// patchable"; false is the unfixable set — remove the package, disable the
+	// service, or accept it, but do not wait for an update.
+	HasFix *bool
 }
 
 // ListInstanceFindings returns findings across the whole fleet.
@@ -130,6 +134,17 @@ func ListInstanceFindings(instanceID string, f FindingFilter) ([]models.VulnFind
 		filter["server_id"] = f.ServerID
 	}
 
+	// fixed_in is omitempty, so a finding with no vendor fix carries no such
+	// field at all rather than an empty string. Both forms must be matched, or
+	// the unfixable set reads as empty on any document written before this.
+	if f.HasFix != nil {
+		if *f.HasFix {
+			filter["fixed_in"] = bson.M{"$nin": bson.A{"", nil}}
+		} else {
+			filter["fixed_in"] = bson.M{"$in": bson.A{"", nil}}
+		}
+	}
+
 	// The tag selector resolves through ResolveTargets, the single answer to
 	// which servers a selector touches. A second matcher here could disagree
 	// with what a workflow means by env:prod.