feat(security): Exposed Services (port-drift) scans UI

[ralyodio]

Makes the §12 scans feature visible in the app — a new per-project Security tab.

What you'll see

• New Security tab in the project tab nav (after Stats).
• Exposed Services page: explanation, Run scan button, an open findings list (severity-tagged host:port (service)), and a recent scans history table.
• Empty states when there's no data yet.

Wiring

• requestPortScan server action queues a port_scans row (status queued) for the off-Railway prober to pick up — RLS ensures the caller owns the project.
• New tables port_scans + port_findings with owner-scoped RLS (mirrors project_repos).
• The page degrades gracefully if the migration isn't applied yet (queries fall back to empty), so the tab renders immediately on deploy — findings light up once the migration is applied and the prober runs.

Still to come (not in this PR)

• The actual prober app (prober/) that consumes queued scans and writes findings — that's the BullMQ/droplet work from the earlier PRs.
• Applying the migration in prod (per repo convention, via psql over the pooler).
• Baseline-confirmation flow + ack/mute finding actions (PRD §12.4).

npm run typecheck passes.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.