feat: implement typed security policy engine and dead-letter storage job recovery

[Praisefotos1]

Summary

Closes #923

Closes #924

#923

• Introduces typed vulnerability policy engine
• Adds versioned policy definitions
• Adds deterministic scan results
• Adds rule IDs
• Adds severity metadata
• Adds remediation guidance
• Returns policy version
• Adds comprehensive tests

#924

• Adds bounded retry handling
• Implements dead-letter state
• Persists retry metadata
• Adds authorized replay support
• Replay is idempotent
• Adds operational metrics
• Adds unit and integration tests

Validation

• All repository CI validation commands completed successfully (99 backend tests passing, tsc --noEmit clean)

Compatibility

• Backwards compatible where possible
• Migration documented if required

[vercel]

@Praisefotos1 is attempting to deploy a commit to the Ayomide Adeniran's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Praisefotos1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[ayomideadeniran]

pr under review