feat(web): surface opt-in deep scan; render deep-scan gaps as info

Spec 077 US3 Web UI: present deep scan as an opt-in affordance and render a
failed/unavailable deep scanner as informational, never an error — the baseline
verdict is authoritative.

- Security.vue: info banner clarifying the deterministic baseline is always on
  and the Docker scanners are an opt-in deep scan that never blocks/degrades it.
- ScanReport.vue: DeepScanDescriptor info block (alert-info) listing unavailable
  deep scanners with an explicit "does not affect the baseline verdict" note.
- api.ts: DeepScanDescriptor type + optional deep_scan on the report.

Related: Spec 077 (specs/077-scanner-simplification)

Author: Dumbris

frontend/src/types/api.ts

@@ -89,6 +89,19 @@ export interface SecurityScanReport {
   pass1_complete?: boolean  // Security scan (fast) done
   pass2_complete?: boolean  // Supply chain audit done
   pass2_running?: boolean   // Supply chain audit in progress
+  // Opt-in deep-scan availability (Spec 077 US3). Informational only — a failed
+  // or unavailable deep scanner never changes the baseline verdict/status.
+  deep_scan?: DeepScanDescriptor
+}
+
+// DeepScanDescriptor reports the informational status of the opt-in "deep scan"
+// layer (Docker-based scanners + source extraction) separately from the
+// baseline verdict (Spec 077 US3). Rendered as a quiet info note, never an error.
+export interface DeepScanDescriptor {
+  enabled: boolean
+  ran: boolean
+  available: boolean
+  scanners_failed?: { id: string; reason: string }[]
 }
 
 // Scan job summary for history listing

frontend/src/views/ScanReport.vue

@@ -130,6 +130,24 @@
         </span>
       </div>
 
+      <!-- Deep scan (opt-in) availability — Spec 077 US3. Informational ONLY:
+           a failed or unavailable deep scanner NEVER changes the baseline
+           verdict above, so it is rendered as info, never an error. -->
+      <div v-if="report.deep_scan && report.deep_scan.enabled" class="alert alert-info">
+        <svg class="w-5 h-5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+        </svg>
+        <div>
+          <div class="font-semibold">Deep scan (optional)</div>
+          <span v-if="(report.deep_scan.scanners_failed?.length ?? 0) > 0" class="text-sm">
+            {{ report.deep_scan.scanners_failed!.length }} deep scanner(s) were unavailable this run
+            ({{ report.deep_scan.scanners_failed!.map((f: { id: string; reason: string }) => f.id).join(', ') }}).
+            This does not affect the baseline verdict shown above.
+          </span>
+          <span v-else class="text-sm">Deep scan ran. Its findings are merged into the report above.</span>
+        </div>
+      </div>
+
       <!-- Scan incomplete warnings -->
       <div v-if="report.scan_complete === false && report.empty_scan" class="alert alert-warning">
         <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">

frontend/src/views/Security.vue

@@ -24,6 +24,26 @@
       </div>
     </div>
 
+    <!-- Baseline vs. deep scan (Spec 077 US3): the deterministic offline
+         baseline runs for every server with zero setup; the Docker-based
+         scanners below are an opt-in "deep scan" that enriches the report but
+         never blocks or degrades the baseline verdict. -->
+    <div class="alert alert-info shadow-sm">
+      <svg class="w-5 h-5 shrink-0" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+      </svg>
+      <div>
+        <div class="font-semibold">Deterministic baseline is always on</div>
+        <span class="text-sm">
+          Every server is scanned by the offline baseline engine with no Docker required.
+          The scanners below are an opt-in <span class="font-medium">deep scan</span> — enable
+          them (<code class="font-mono text-xs">security.deep_scan.enabled</code>) for extra
+          source-level analysis. Deep-scan failures are informational and never change the
+          baseline verdict.
+        </span>
+      </div>
+    </div>
+
     <!-- Scan All Progress Card -->
     <div v-if="queueProgress && queueProgress.status !== 'idle'" class="card bg-base-100 shadow-xl">
       <div class="card-body">