feat(039): Security Scanner Plugin System

Implement pluggable security scanner system for analyzing quarantined
MCP servers before approval. Docker-based scanners run in isolated
containers, produce SARIF reports, and integrate with the existing
quarantine workflow.

## Changes
- Scanner plugin architecture: types, registry (4 bundled scanners),
  Docker runner, SARIF 2.1.0 parser, parallel scan engine
- Storage: 4 new BBolt buckets (scanners, jobs, reports, baselines)
- Security service: install/configure scanners, scan/approve/reject
  workflow, integrity verification, risk scoring
- REST API: 13 endpoints for scanner management, scan operations,
  approval flow, and security overview
- CLI: mcpproxy security command group with 12 subcommands
- Web UI: Security dashboard with scanner marketplace, scan trigger,
  findings viewer, approve/reject actions
- SSE events: scan lifecycle and integrity alert events
- Documentation: feature guide, spec, plan, autonomous summary

## Testing
- 500+ tests passing across scanner, storage, httpapi, config packages
- Race detector clean on all new code
- Frontend type-checks clean and builds successfully

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

cmd/mcpproxy/main.go

@@ -178,6 +178,9 @@ func main() {
 	// Add feedback command (Spec 036)
 	feedbackCmd := GetFeedbackCommand()
 
+	// Add security command (Spec 039: Security scanner plugins)
+	securityCmd := GetSecurityCommand()
+
 	// Add connect/disconnect commands
 	connectCmd := GetConnectCommand()
 	disconnectCmd := GetDisconnectCommand()
@@ -199,6 +202,7 @@ func main() {
 	rootCmd.AddCommand(tokenCmd)
 	rootCmd.AddCommand(telemetryCmd)
 	rootCmd.AddCommand(feedbackCmd)
+	rootCmd.AddCommand(securityCmd)
 	rootCmd.AddCommand(connectCmd)
 	rootCmd.AddCommand(disconnectCmd)