feat: finding 增加详细报告字段 report(Markdown),详情页证据下方渲染

- findings 表加 report 列(TEXT 默认空,schema + ALTER 补旧库)
- 仅 GetFinding 查 report,列表/分页不带以免 payload 膨胀;FindingDTO.report omitempty
- 详情页「概览」证据卡下方新增「详细报告」卡,复用 <Markdown> 组件渲染,空时占位提示
- 前端 Finding.report? 类型;mock 单条 GET 返回 report、列表剥掉,并给 f-12 加示例报告
- 字段先留空,后续由写入方填充;db 测试补 report 往返断言

next build 通过。

db/findings.go

@@ -21,6 +21,7 @@ type DBFinding struct {
 	Worker          string
 	AssetIDs        []int64
 	Status          string
+	Report          string // 详细报告(Markdown);仅 GetFinding 填充,列表查询不带
 	CreatedAt       time.Time
 	TaskDescription string // populated via LEFT JOIN on tasks
 }
@@ -244,25 +245,27 @@ func (d *DB) FindingStats() (*FindingStats, error) {
 	return st, rows.Err()
 }
 
-// GetFinding returns a single finding row (with task_description joined), or nil
-// when no row has that id.
+// GetFinding returns a single finding row (with task_description joined and the
+// full Markdown report), or nil when no row has that id. Unlike the list queries
+// it also selects `report` — that column is only needed on the detail page.
 func (d *DB) GetFinding(id int64) (*DBFinding, error) {
-	rows, err := d.Query(`SELECT `+findingSelectCols+`
+	f := &DBFinding{}
+	var aidsJSON string
+	err := d.QueryRow(`SELECT `+findingSelectCols+`, COALESCE(f.report, '')
 		FROM findings f
 		LEFT JOIN tasks t ON f.task_id = t.id
-		WHERE f.id = $1`, id)
-	if err != nil {
-		return nil, err
-	}
-	defer rows.Close()
-	out, err := scanFindings(rows)
-	if err != nil {
-		return nil, err
-	}
-	if len(out) == 0 {
+		WHERE f.id = $1`, id).Scan(
+		&f.ID, &f.TaskID, &f.NodeID, &f.VulnClass, &f.Name, &f.Severity,
+		&f.Summary, &f.Evidence, &f.Worker, &aidsJSON, &f.Status, &f.CreatedAt,
+		&f.TaskDescription, &f.Report)
+	if err == sql.ErrNoRows {
 		return nil, nil
 	}
-	return out[0], nil
+	if err != nil {
+		return nil, err
+	}
+	_ = json.Unmarshal([]byte(aidsJSON), &f.AssetIDs)
+	return f, nil
 }
 
 // SetFindingStatus updates one finding's triage state. Returns rows affected.