P3 audit remediation: wire dead Settings→Scanners knobs + README truth - #26

Implements the P3 tier of docs/reviews/full-audit-2026-07-05.md §10 (feature gaps that mislead users).

Stacked on #25 (P2). Base is the P2 branch so this PR's diff shows only P3.

The three dead Settings→Scanners knobs (QUA-3) — now real

• FEAT-6. The stored Grype ignore config is applied at scan time. New scanners/grype_policy.py materializes ScannerSettings.grype_ignore into tmpfs; the worker hands it to Grype via a -c <path> config flag (mirroring the Trivy-policy materialization), carried on a private env-overlay key the Grype runner turns into argv (never leaked to the child).
• FEAT-7. The New Scan form prefills its severity filter and ignore-unfixed toggle from GET /settings/scanners on mount, so changing default_severities / default_ignore_unfixed actually affects new scans instead of being overridden by hardcoded form values. Fetch failure falls back to the built-in defaults.
• FEAT-4. The maintenance tick honors auto_update_db + db_update_interval_hours — new workers/db_update.py runs trivy image --download-db-only and grype db update best-effort when enabled and the interval has elapsed (in-process last-run marker; a restart re-checks). Failures are logged, never raised.

README truth (DOC-1 / DOC-2 / DOC-5 + feature de-scoping)

• DOC-1. Docker Hub publishing (securedbytyler/scrye, :latest/:<version>/:dev) is now described as in-scope; the "no published registry image" claims are removed (Quick start, Building, Roadmap).
• DOC-2 / FEAT-1/2/3/8. Uploaded image-tar targets, Docker-environment multi-select scan launch, and filesystem-archive upload are marked not yet implemented; VEX / .trivyignore are described as global (Settings → Scanners), not per-scan.
• DOC-5. The ECR/GCR/ACR credential-helper "binaries are not bundled" caveat is stated in the features/integrations sections.
• FEAT-5 / FEAT-10. Offline/air-gapped DB import and an admin bulk secret re-encryption (key-rotation) action are listed as not-yet-implemented on the roadmap; the key-rotation note is corrected to stop implying a re-encryption tool exists.

Scope note

The audit allowed "implement or explicitly de-scope in docs" for FEAT-1/2/3/5. Those larger feature builds (tar upload, multi-select launcher, archive upload, offline DB import, rotation tool) are de-scoped in the docs here rather than built in this tier; the three misleading Settings knobs — the audit's headline P3 item — are wired.

Testing

• New tests/test_audit_p3.py: Grype -c config flag + tmpfs materialization; DB-update tick (disabled / due-then-skip / interval re-fire / missing-binary-safe). Frontend tsc -b, ESLint, Prettier clean on NewScanPage.tsx.
• Full backend suite: 432 passed, 3 skipped. ruff + black clean.

Deviation logged in docs/PLAN.md § Deviations (2026-07-05 P3 entry).