fix(039): resolve 13 QA findings in security scanner plugin system

Bundled fix for bugs surfaced by a full QA pass of Spec 039. Each finding has
a one-line code reference and a regression test where applicable.

Critical:
* F-01 security approve now actually unquarantines the server. The scanner
  Service gets a new ServerUnquarantiner dependency injected from
  server.Server.UnquarantineServer; ApproveServer calls it after persisting
  the integrity baseline. Tool indexing and quarantine-bucket removal follow
  the existing unquarantine path. Critical-findings guard still blocks the
  call before anything mutates. TestServiceApproveServerCallsUnquarantiner
  and TestServiceApproveServerCriticalDoesNotUnquarantine pin the contract.
* F-02 Source resolver no longer misreads a server's positional data-dir
  argument as source code. For package-runner commands (npx, uvx, pipx,
  pnpm dlx, bunx, yarn dlx) resolveFromPackageCache runs first; arg-scan
  fallback only accepts directories containing a source marker
  (package.json, pyproject.toml, setup.py, Cargo.toml, go.mod, or a source
  file). Regression tests cover the filesystem-server false-positive case
  and the legitimate python-script arg case.

High:
* F-03 macOS keychain probe no longer pops the "Keychain Not Found" modal.
  KeyringProvider.IsAvailable uses a read-only Get probe with a 2s timeout
  and a headless-environment fast path instead of keyring.Set. Public Get,
  Store, Delete, List, and both registry helpers are wrapped in a new
  runWithTimeout helper (3s hard deadline) backed by ErrKeyringTimeout.
  Scanner ConfigureScanner already falls back to in-config storage on Store
  errors. TestKeyringProvider_IsAvailable_HangingBackend proves the bail-out.
* F-04 UI Approve buttons are now scanner-aware. ServerCard, ServerDetail
  and ScanReport call the new securityApproveServer store action. A custom
  modal gates force-approve on servers with no scan or with critical
  findings; the legacy unquarantineServer path is retained only for admin
  and the Scan First action.
* F-05 CLI security scan no longer hangs after the job reports completed.
  The poll loop now terminates on completed|failed|cancelled and prints live
  progress lines (N run, M running, F failed).

Medium:
* F-06 --dry-run prints a structured plan (source method, source path,
  scanner images, commands, timeouts) and exits without invoking the scan
  endpoint. No containers start.
* F-09 Scanner status vocabulary unified between table and JSON output
  (available | pulling | installed | configured | error).
* F-10 security report text output now contains "Scanners: X run, Y failed
  (names) of Z" and a coverage warning when any scanner did not run, so a
  user cannot mistake scanner crashes for "clean".
* F-11 Scan history endpoint returns the aggregated risk_score instead of
  always zero.

UX:
* F-12 Dashboard "Security Scan" chip is now a live router-link to /security
  with no "soon" placeholder; matches adjacent Docker / Quarantine chips.
* F-14 security overview shows "Last scan: never" instead of
  0001-01-01 00:00:00, and JSON emits last_scan_at: null.
* F-15 security configure returns in ~3s (was 60s+), bumped client timeout
  from 10s to 60s as additional safety, added existence prefetch so typos
  return 404 fast.
* F-16 scan --all redraws the progress table in place on TTY via ANSI
  cursor escapes; falls back to per-line output when piped; FINDINGS column
  now populated from findings_count.

Extra:
* mcpproxy security subcommands now honor --config and --data-dir global
  flags (newSecurityCLIClient checks the package-level configFile/dataDir
  before calling config.LoadFromFile, mirroring main.go).

Not fixed (documented):
* F-07 ramparts scanner container ships a GLIBC_2.39-linked binary that
  fails on arm64 macOS. Upstream scanner image issue, not mcpproxy code.
* F-13 cisco-mcp-scanner stdout contains a hardcoded server_url header.
  Cosmetic upstream scanner output quirk.

Post-fix revalidation: 6 of 7 scanners run end-to-end on arm64 macOS
against the three test servers (everything, fetch-test, filesystem-test).
The QA report in docs/qa/security-scanners-2026-04-10.html now contains a
§11 "After-Fix Revalidation" section with per-finding verification
evidence, updated code-landscape table, and reproduction instructions.

Tests: internal/secret, internal/security, internal/security/scanner,
cmd/mcpproxy, frontend unit tests all pass. golangci-lint: 0 issues.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claude

cmd/mcpproxy/security_cmd.go

@@ -0,0 +1,150 @@
+package main
+
+import (
+	"testing"
+	"time"
+
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
+)
+
+// TestScannerDisplayStatus verifies F-09: scanner status vocabulary is
+// consistent and rich enough to distinguish "available" / "pulling" /
+// "installed" / "configured" / "error" in BOTH table and JSON outputs.
+func TestScannerDisplayStatus(t *testing.T) {
+	cases := []struct {
+		in   string
+		want string
+	}{
+		{"available", "available"},
+		{"pulling", "pulling"},
+		{"installed", "installed"},
+		{"configured", "configured"},
+		{"error", "error"},
+		{"", "unknown"},
+		// Future / unexpected values pass through unchanged so they don't
+		// silently get hidden behind a hard-coded mapping.
+		{"some-new-state", "some-new-state"},
+	}
+	for _, c := range cases {
+		got := scannerDisplayStatus(c.in)
+		if got != c.want {
+			t.Errorf("scannerDisplayStatus(%q) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}
+
+// TestComputeScanHardTimeout verifies F-05: the per-scanner timeout is
+// extrapolated into a sensible whole-scan timeout that won't return early
+// nor hang for the duration of the universe.
+func TestComputeScanHardTimeout(t *testing.T) {
+	// Nil config -> 15-minute fallback.
+	if got := computeScanHardTimeout(nil, ""); got != 15*time.Minute {
+		t.Errorf("nil cfg: got %s, want 15m", got)
+	}
+
+	// Config with no security section -> fallback.
+	cfg := &config.Config{}
+	if got := computeScanHardTimeout(cfg, ""); got != 15*time.Minute {
+		t.Errorf("nil security: got %s, want 15m", got)
+	}
+
+	// Config with explicit per-scanner timeout, with explicit scanner list:
+	// 60s * 3 + 30s = 3m30s, but we floor at 15m for sanity.
+	cfg = &config.Config{
+		Security: &config.SecurityConfig{
+			ScanTimeoutDefault: config.Duration(60 * time.Second),
+		},
+	}
+	if got := computeScanHardTimeout(cfg, "a,b,c"); got != 15*time.Minute {
+		t.Errorf("60s*3 with floor: got %s, want 15m", got)
+	}
+
+	// Per-scanner 5m, no flag (default 8 scanners): 5m*8 + 30s = 40m30s,
+	// capped at 30m.
+	cfg = &config.Config{
+		Security: &config.SecurityConfig{
+			ScanTimeoutDefault: config.Duration(5 * time.Minute),
+		},
+	}
+	if got := computeScanHardTimeout(cfg, ""); got != 30*time.Minute {
+		t.Errorf("5m*8 cap: got %s, want 30m", got)
+	}
+
+	// Per-scanner 4m, 6 scanners: 4m*6 + 30s = 24m30s — within bounds.
+	cfg = &config.Config{
+		Security: &config.SecurityConfig{
+			ScanTimeoutDefault: config.Duration(4 * time.Minute),
+		},
+	}
+	got := computeScanHardTimeout(cfg, "s1,s2,s3,s4,s5,s6")
+	want := 4*time.Minute*6 + 30*time.Second
+	if got != want {
+		t.Errorf("4m*6: got %s, want %s", got, want)
+	}
+}
+
+// TestNormalizeOverviewLastScan verifies F-14: Go zero-time `last_scan_at`
+// values are scrubbed to JSON null in both table and JSON outputs.
+func TestNormalizeOverviewLastScan(t *testing.T) {
+	cases := []struct {
+		name string
+		in   map[string]interface{}
+		// We assert nil-ness via key presence and value.
+		wantPresent bool
+		wantNil     bool
+		wantValue   interface{}
+	}{
+		{
+			name:        "missing key inserted as nil",
+			in:          map[string]interface{}{},
+			wantPresent: true,
+			wantNil:     true,
+		},
+		{
+			name:        "explicit empty string -> nil",
+			in:          map[string]interface{}{"last_scan_at": ""},
+			wantPresent: true,
+			wantNil:     true,
+		},
+		{
+			name:        "Go zero-time RFC3339 -> nil",
+			in:          map[string]interface{}{"last_scan_at": "0001-01-01T00:00:00Z"},
+			wantPresent: true,
+			wantNil:     true,
+		},
+		{
+			name:        "real timestamp preserved",
+			in:          map[string]interface{}{"last_scan_at": "2025-01-15T10:30:00Z"},
+			wantPresent: true,
+			wantNil:     false,
+			wantValue:   "2025-01-15T10:30:00Z",
+		},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			normalizeOverviewLastScan(c.in)
+			v, present := c.in["last_scan_at"]
+			if present != c.wantPresent {
+				t.Errorf("present=%v, want %v", present, c.wantPresent)
+			}
+			if c.wantNil && v != nil {
+				t.Errorf("expected nil value, got %v (%T)", v, v)
+			}
+			if !c.wantNil && c.wantValue != nil && v != c.wantValue {
+				t.Errorf("value = %v, want %v", v, c.wantValue)
+			}
+		})
+	}
+
+	// Nil map should not panic.
+	normalizeOverviewLastScan(nil)
+}
+
+// TestClearPreviousLines verifies F-16: passing 0 or negative values is a
+// safe no-op (so the first redraw cycle doesn't blow up the terminal).
+func TestClearPreviousLines(t *testing.T) {
+	// We can't easily capture stdout here without restructuring; just verify
+	// the function doesn't panic on edge cases.
+	clearPreviousLines(0)
+	clearPreviousLines(-1)
+}