feat: security center page (/security)

Project-scoped security surface: scan trigger (dependency /
configuration / comprehensive, optional service), security score and
vulnerability metric cards, findings list with severity badges and
resolve/ignore actions, and scan history.

Fixed a latent bug in GET /projects/:id/security/metrics: it selected a
non-existent `score` column (the score lives in the security_scans
summary jsonb), so the endpoint 500'd on every project.

Verified live: comprehensive scan produced 4 real findings (insecure
public URL, curl|sh build, http source, unpinned tag) with score 47;
resolve flow and metrics aggregation confirmed.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

app/frontend/src/app/layout/PlatformShell.tsx

@@ -15,6 +15,7 @@ import {
   RefreshCw,
   Search,
   Settings,
+  Shield,
   ShieldCheck,
   Sun,
   UploadCloud,
@@ -36,6 +37,7 @@ const navItems = [
   { label: 'Templates', href: '/templates', icon: LayoutTemplate },
   { label: 'Databases', href: '/databases', icon: Database },
   { label: 'HA', href: '/ha', icon: ShieldCheck },
+  { label: 'Security', href: '/security', icon: Shield },
   { label: 'Usage', href: '/usage', icon: ChartBar },
   { label: 'People', href: '/people', icon: Users },
   { label: 'Settings', href: '/settings', icon: Settings },