feat: 发现列表改为服务端分页 + 全表聚合(去掉 500 上限)

- db.ListFindingsPage:WHERE(严重度/状态/类型)+ ORDER BY(严重度 CASE 或时间)+ LIMIT/OFFSET,返回当前页与匹配总数
- db.FindingStats:全表 COUNT FILTER 聚合(总数/待处理/高/中/低)+ DISTINCT 漏洞类型,供统计卡与类型下拉,不受分页影响
- GET /api/exploration/findings 带 page/limit → 分页对象{items,total,page,page_size};不带 → 保留裸数组(dashboard 汇总,与 intents 端点兼容策略一致)
- 新增 GET /api/exploration/findings/stats
- 筛选/排序全部下推到 SQL,前端不再一次拉全量再本地切片
- 资产按当前页所需批量解析;per-task 视图经 node_id 关联独立行,复用同一状态并补齐绑定资产
- 前端:发现页改为服务端驱动分页/筛选/排序,统计卡与类型下拉走 stats 接口
- db 层加 findings 分页/筛选/聚合测试(隔离标记 vulnclass,自清理)

web/src/lib/api.ts

@@ -6,7 +6,8 @@
 import { MOCK } from "@/lib/mock/enabled";
 import { mockHandle } from "@/lib/mock/handler";
 import type {
-  Task, Stats, Asset, AssetNode, Edge, Company, TaskNode, Finding, FindingStatus, Activity,
+  Task, Stats, Asset, AssetNode, Edge, Company, TaskNode, Finding, FindingStatus,
+  FindingsPage, FindingStats, FindingQuery, Activity,
   Audit, TrafficResp, TrafficDetail, TrafficHost, Settings, LLMProfile, Agent, AgentDetail, PromptVar,
   PromptVersion, MCPServer, MCPTool, SkillItem, TokenUsage, TokenTotal, DailyTokenBucket,
   Tool, Conversation, AgentTrigger, ChatAttachment,
@@ -232,6 +233,15 @@ export const api = {
   // ---- exploration (per task) ----
   frontier: (task?: string) => get<TaskNode[]>(`/exploration/frontier${tq(task)}`).then(arr),
   findings: (task?: string) => get<Finding[]>(`/exploration/findings${tq(task)}`).then(arr),
+  findingsPage: (q: FindingQuery) => {
+    const p = new URLSearchParams({ page: String(q.page), limit: String(q.pageSize) });
+    if (q.severity && q.severity !== "all") p.set("severity", q.severity);
+    if (q.status && q.status !== "all") p.set("status", q.status);
+    if (q.vulnclass && q.vulnclass !== "all") p.set("vulnclass", q.vulnclass);
+    if (q.sort) p.set("sort", q.sort);
+    return get<FindingsPage>(`/exploration/findings?${p.toString()}`);
+  },
+  findingStats: () => get<FindingStats>("/exploration/findings/stats"),
   setFindingStatus: (id: string, status: FindingStatus) =>
     patch<{ id: string; status: FindingStatus }>(`/exploration/findings/${id}`, { status }),
   intents: (task?: string) => get<TaskNode[]>(`/exploration/intents${tq(task)}`).then(arr),

web/src/lib/mock/handler.ts

@@ -73,7 +73,43 @@ function route(m: string, path: string, seg: string[], q: URLSearchParams, b: Re
 
   // ── exploration ──
   if (path === "/exploration/frontier") return D.frontier;
-  if (path === "/exploration/findings") return task ? D.findings.filter((f) => f.task_id === task) : D.findings;
+  if (path === "/exploration/findings/stats") {
+    const vulnclasses = Array.from(new Set(D.findings.map((f) => f.vulnclass))).sort();
+    return {
+      total: D.findings.length,
+      pending: D.findings.filter((f) => f.status === "pending").length,
+      high: D.findings.filter((f) => f.severity === "high").length,
+      medium: D.findings.filter((f) => f.severity === "medium").length,
+      low: D.findings.filter((f) => f.severity === "low").length,
+      vulnclasses,
+    };
+  }
+  if (path === "/exploration/findings") {
+    if (task) return D.findings.filter((f) => f.task_id === task);
+    // 全局:带 page/limit → 分页对象;否则裸数组(dashboard)。
+    if (!q.has("page") && !q.has("limit")) return D.findings;
+    const sev = { high: 3, medium: 2, low: 1 } as const;
+    let list = D.findings.slice();
+    const fSev = q.get("severity");
+    const fStatus = q.get("status");
+    const fVuln = q.get("vulnclass");
+    if (fSev) list = list.filter((f) => f.severity === fSev);
+    if (fStatus) list = list.filter((f) => f.status === fStatus);
+    if (fVuln) list = list.filter((f) => f.vulnclass === fVuln);
+    list.sort((a, b) =>
+      q.get("sort") === "severity"
+        ? sev[b.severity] - sev[a.severity] || +new Date(b.ts) - +new Date(a.ts)
+        : +new Date(b.ts) - +new Date(a.ts),
+    );
+    const page = Number(q.get("page") ?? 1);
+    const pageSize = Number(q.get("limit") ?? 20);
+    return {
+      items: list.slice((page - 1) * pageSize, page * pageSize),
+      total: list.length,
+      page,
+      page_size: pageSize,
+    };
+  }
   if (path === "/exploration/intents") return D.intents;
   if (path === "/exploration/tokens") return { workers: D.tokenWorkers, total: D.tokenTotal };
   if (path === "/exploration/graph") return D.explorationGraph;

web/src/lib/types.ts

@@ -265,6 +265,34 @@ export interface Finding {
   ts: string;
 }
 
+// FindingsPage 是发现列表的服务端分页响应。
+export interface FindingsPage {
+  items: Finding[];
+  total: number;
+  page: number;
+  page_size: number;
+}
+
+// FindingStats 是发现全表聚合(统计卡 + 漏洞类型下拉),服务端计算,不受分页影响。
+export interface FindingStats {
+  total: number;
+  pending: number;
+  high: number;
+  medium: number;
+  low: number;
+  vulnclasses: string[];
+}
+
+// FindingQuery 是发现列表分页/筛选/排序参数。
+export interface FindingQuery {
+  page: number;
+  pageSize: number;
+  severity?: "all" | Severity;
+  status?: "all" | FindingStatus;
+  vulnclass?: string;
+  sort?: "severity" | "time";
+}
+
 // ---- Activity / sessions ----
 export type ActivityKind =
   | "tool_use"