fix: resolve remaining LOW security-edge items P3-3 and SC-14 - #77

Summary

Resolves the two still-open LOW items with a security edge from the 2026-07 review-remediation backlog (docs/reviews/STATUS.md § "Remaining work"). They touch disjoint files and land as two separate commits.

P3-3 — surface credential/filter option-fetch failures (frontend)

NewScanPage.tsx and ScansPage.tsx each wrapped their option fetch in an empty catch, so a failed load left the credential/filter pickers silently empty — indistinguishable from "none configured." An operator could then launch a private-image or -repository scan anonymously, believing no credential was saved, only for the scan to fail minutes later with an opaque auth error.

• On failure, set an optionsError state and reset the lists (rather than swallowing the error).
• New Scan shows a yellow warning Alert with a Retry action above the registry/git-credential picker, telling the operator saved credentials couldn't load and launching now would scan anonymously.
• Scan history shows a non-blocking inline warning (with Retry) that the initiator/tag lists may be incomplete.
• A successful (re)load clears the warning.

No frontend test added: the Vitest suite runs in the Node environment and covers only pure src/lib/ helpers — there is no jsdom/React-Testing-Library harness to render a page component, and adding one is out of scope for a minimal LOW fix (consistent with the existing untested page-effect posture noted in STATUS.md § 1).

SC-14 — keep the backend test suite and dev scripts out of the runtime image (docker)

The final image stage copies the backend tree wholesale (COPY … backend/ /app/backend/), shipping backend/tests/ and backend/scripts/ into the published scanner image — needless bloat and attack surface.

• Excluded backend/tests/ and backend/scripts/ from the build context via the root .dockerignore (the only ignore file Docker honors for a normal build; a backend/.dockerignore would be a silent no-op), leaving the layer ordering of the final stage untouched.
• The runtime COPY backend/ now brings in only alembic/, alembic.ini, app/, pyproject.toml, and requirements.lock — everything Alembic migrations + uvicorn app.main:app need.
• Verified no runtime code imports tests/scripts (app and the Alembic env.py import only from app), so the image still runs and imports unchanged.
• Guarded two ways: a static check in test_dockerfile_supply_chain.py, plus a content assertion in the CI dogfood job ("Image — build + dogfood self-scan") that runs against the real built image and fails if /app/backend/tests or /app/backend/scripts is present (or if the runtime app/alembic trees go missing). The exclusion was also pre-confirmed by a faithful .dockerignore pattern-match simulation.

Testing

• Frontend: ESLint, Prettier, tsc, and Vitest (21 tests) all green.
• Backend: ruff and black --check clean; test_dockerfile_supply_chain.py (incl. the new SC-14 guard) passes.
• CI dogfood image build + self-scan green, and the new content-assertion step confirms the built image excludes backend/tests/backend/scripts.

Docs

• Dated docs/ARCHIVE.md § 14 entries added for both fixes.
• docs/reviews/STATUS.md moves P3-3 and SC-14 from "Remaining work" to "Resolved."