fix(039): consistent threat counts in Security tab

AggregateReports now classifies findings before summarizing.
ReportSummary includes dangerous/warnings/info_level counts.
Frontend reads summary from API response.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

frontend/src/types/api.ts

@@ -67,11 +67,25 @@ export interface SecurityScanReport {
   risk_score: number
   findings: SecurityScanFinding[]
   finding_counts: SecurityScanFindingCounts
+  summary: SecurityScanReportSummary
   scanned_at: string
   duration_ms?: number
   scanners_used?: string[]
 }
 
+// Summary from the aggregated report API (matches Go ReportSummary)
+export interface SecurityScanReportSummary {
+  critical: number
+  high: number
+  medium: number
+  low: number
+  info: number
+  total: number
+  dangerous: number   // Threat level counts
+  warnings: number
+  info_level: number
+}
+
 // Server types
 export interface Server {
   name: string

frontend/src/views/ServerDetail.vue

@@ -565,25 +565,25 @@
                   <div class="stats shadow bg-base-100">
                     <div class="stat py-3 px-4">
                       <div class="stat-title text-xs">Dangerous</div>
-                      <div class="stat-value text-lg text-error">{{ scanReport.finding_counts?.dangerous ?? 0 }}</div>
+                      <div class="stat-value text-lg text-error">{{ scanReport.summary?.dangerous ?? 0 }}</div>
                     </div>
                   </div>
                   <div class="stats shadow bg-base-100">
                     <div class="stat py-3 px-4">
                       <div class="stat-title text-xs">Warnings</div>
-                      <div class="stat-value text-lg text-warning">{{ scanReport.finding_counts?.warning ?? 0 }}</div>
+                      <div class="stat-value text-lg text-warning">{{ scanReport.summary?.warnings ?? 0 }}</div>
                     </div>
                   </div>
                   <div class="stats shadow bg-base-100">
                     <div class="stat py-3 px-4">
                       <div class="stat-title text-xs">Info</div>
-                      <div class="stat-value text-lg text-info">{{ scanReport.finding_counts?.info ?? 0 }}</div>
+                      <div class="stat-value text-lg text-info">{{ scanReport.summary?.info_level ?? 0 }}</div>
                     </div>
                   </div>
                   <div class="stats shadow bg-base-100">
                     <div class="stat py-3 px-4">
                       <div class="stat-title text-xs">Total</div>
-                      <div class="stat-value text-lg">{{ scanReport.finding_counts?.total ?? 0 }}</div>
+                      <div class="stat-value text-lg">{{ scanReport.summary?.total ?? 0 }}</div>
                     </div>
                   </div>
                 </div>

internal/security/scanner/engine.go

@@ -427,6 +427,9 @@ func AggregateReports(jobID, serverName string, reports []*ScanReport) *Aggregat
 		agg.Reports = append(agg.Reports, *r)
 	}
 
+	// Classify findings that lack threat_type/threat_level (legacy data)
+	ClassifyAllFindings(agg.Findings)
+
 	agg.RiskScore = CalculateRiskScore(agg.Findings)
 	agg.Summary = SummarizeFindings(agg.Findings)
 	return agg

internal/security/scanner/sarif.go

@@ -280,6 +280,7 @@ func CalculateRiskScore(findings []ScanFinding) int {
 func SummarizeFindings(findings []ScanFinding) ReportSummary {
 	summary := ReportSummary{Total: len(findings)}
 	for _, f := range findings {
+		// Count by CVSS severity
 		switch f.Severity {
 		case SeverityCritical:
 			summary.Critical++
@@ -292,6 +293,15 @@ func SummarizeFindings(findings []ScanFinding) ReportSummary {
 		case SeverityInfo:
 			summary.Info++
 		}
+		// Count by user-facing threat level
+		switch f.ThreatLevel {
+		case ThreatLevelDangerous:
+			summary.Dangerous++
+		case ThreatLevelWarning:
+			summary.Warnings++
+		case ThreatLevelInfo:
+			summary.InfoLevel++
+		}
 	}
 	return summary
 }

internal/security/scanner/types.go

@@ -145,14 +145,17 @@ type AggregatedReport struct {
 	Reports    []ScanReport  `json:"reports"`
 }
 
-// ReportSummary provides counts by severity
+// ReportSummary provides counts by severity and threat level
 type ReportSummary struct {
-	Critical int `json:"critical"`
-	High     int `json:"high"`
-	Medium   int `json:"medium"`
-	Low      int `json:"low"`
-	Info     int `json:"info"`
-	Total    int `json:"total"`
+	Critical  int `json:"critical"`
+	High      int `json:"high"`
+	Medium    int `json:"medium"`
+	Low       int `json:"low"`
+	Info      int `json:"info"`
+	Total     int `json:"total"`
+	Dangerous int `json:"dangerous"`  // Threat level: tool poisoning, prompt injection
+	Warnings  int `json:"warnings"`   // Threat level: rug pull, high CVEs
+	InfoLevel int `json:"info_level"` // Threat level: low CVEs, informational
 }
 
 // IntegrityBaseline represents the approved integrity state for a server