fix(039): wire scan summary into management service path

The /api/v1/servers endpoint uses management.ListServers(), not the
legacy GetAllServers(). Moved scan summary enrichment to the httpapi
handler. Also re-classify legacy findings without threat_level on read.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

internal/httpapi/server.go

@@ -501,15 +501,13 @@ func (s *Server) setupRoutes() {
 			r.Get("/tools/export", s.handleExportToolDescriptions)
 
 			// Security scanner scan/approval routes (Spec 039)
-			if s.securityController != nil {
-				r.Post("/scan", s.handleStartScan)
-				r.Get("/scan/status", s.handleGetScanStatus)
-				r.Get("/scan/report", s.handleGetScanReport)
-				r.Post("/scan/cancel", s.handleCancelScan)
-				r.Post("/security/approve", s.handleSecurityApprove)
-				r.Post("/security/reject", s.handleSecurityReject)
-				r.Get("/integrity", s.handleCheckIntegrity)
-			}
+			r.Post("/scan", s.handleStartScan)
+			r.Get("/scan/status", s.handleGetScanStatus)
+			r.Get("/scan/report", s.handleGetScanReport)
+			r.Post("/scan/cancel", s.handleCancelScan)
+			r.Post("/security/approve", s.handleSecurityApprove)
+			r.Post("/security/reject", s.handleSecurityReject)
+			r.Get("/integrity", s.handleCheckIntegrity)
 		})
 
 		// Search
@@ -587,16 +585,14 @@ func (s *Server) setupRoutes() {
 		r.Delete("/connect/{client}", s.handleDisconnectClient)
 
 		// Security scanner management routes (Spec 039)
-		if s.securityController != nil {
-			r.Route("/security", func(r chi.Router) {
-				r.Get("/scanners", s.handleListScanners)
-				r.Post("/scanners/install", s.handleInstallScanner)
-				r.Delete("/scanners/{id}", s.handleRemoveScanner)
-				r.Put("/scanners/{id}/config", s.handleConfigureScanner)
-				r.Get("/scanners/{id}/status", s.handleGetScannerStatus)
-				r.Get("/overview", s.handleSecurityOverview)
-			})
-		}
+		r.Route("/security", func(r chi.Router) {
+			r.Get("/scanners", s.handleListScanners)
+			r.Post("/scanners/install", s.handleInstallScanner)
+			r.Delete("/scanners/{id}", s.handleRemoveScanner)
+			r.Put("/scanners/{id}/config", s.handleConfigureScanner)
+			r.Get("/scanners/{id}/status", s.handleGetScannerStatus)
+			r.Get("/overview", s.handleSecurityOverview)
+		})
 	})
 
 	// SSE events (protected by API key) - support both GET and HEAD
@@ -941,6 +937,27 @@ func (s *Server) handleGetServers(w http.ResponseWriter, r *http.Request) {
 		// Enrich with quarantine stats
 		s.enrichServersWithQuarantineStats(serverValues)
 
+		// Enrich with security scan summary (Spec 039)
+		if s.securityController != nil {
+			for i := range serverValues {
+				if summary := s.securityController.GetScanSummary(r.Context(), serverValues[i].Name); summary != nil {
+					serverValues[i].SecurityScan = &contracts.SecurityScanSummary{
+						LastScanAt: summary.LastScanAt,
+						RiskScore:  summary.RiskScore,
+						Status:     summary.Status,
+					}
+					if summary.FindingCounts != nil {
+						serverValues[i].SecurityScan.FindingCounts = &contracts.FindingCounts{
+							Dangerous: summary.FindingCounts.Dangerous,
+							Warning:   summary.FindingCounts.Warning,
+							Info:      summary.FindingCounts.Info,
+							Total:     summary.FindingCounts.Total,
+						}
+					}
+				}
+			}
+		}
+
 		// Dereference stats pointer
 		var statsValue contracts.ServerStats
 		if stats != nil {

internal/security/scanner/service.go

@@ -626,6 +626,7 @@ type IntegrityViolation struct {
 // GetScanSummary returns a compact scan summary for a server (for the server list API).
 // Returns nil if no scans have been run for this server.
 func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSummary {
+
 	// Check for active scan
 	if active := s.engine.GetActiveJob(serverName); active != nil {
 		return &ScanSummary{
@@ -651,11 +652,13 @@ func (s *Service) GetScanSummary(ctx context.Context, serverName string) *ScanSu
 		return summary
 	}
 
-	// Aggregate findings
+	// Aggregate findings and apply classification if missing
 	var allFindings []ScanFinding
 	for _, r := range reports {
 		allFindings = append(allFindings, r.Findings...)
 	}
+	// Re-classify findings that lack threat_level (legacy data)
+	ClassifyAllFindings(allFindings)
 
 	summary.RiskScore = CalculateRiskScore(allFindings)
 

internal/server/server.go

@@ -874,9 +874,11 @@ func (s *Server) GetAllServers() ([]map[string]interface{}, error) {
 
 		// Spec 039: Add security scan summary if available
 		if s.securityScanner != nil {
-			if scanSummary := s.securityScanner.GetScanSummary(context.Background(), serverStatus.Name); scanSummary != nil {
+			scanSummary := s.securityScanner.GetScanSummary(context.Background(), serverStatus.Name)
+			if scanSummary != nil {
 				serverMap["security_scan"] = scanSummary
 			}
+		} else {
 		}
 
 		result = append(result, serverMap)