Runtime evidence in the SCA dashboard #57

Show #53 evidence next to the static reachability verdict.

• SCA vulnerabilities list (sca_vulnerabilities_list.html): add a Runtime column with one of:
  • Reached from traffic: routes and hit count, e.g. "Reached · POST /upload (anon) · 312". From Attribute runtime hits to live traffic (route, auth state) #69. Add "via E1 (B1)" when it maps to a threat-model entry point (Correlate live traffic with the threat model's entry points #70).
  • Executed: total hits and last seen, but no request context.
  • Loaded: the package is in memory, but no watched symbol was called (Runtime package inventory: loaded versions, drift and live advisories #68). Also used for package-granularity watchlist entries.
  • Not observed / Not loaded: show the coverage % and observation time next to it, e.g. "Not observed · 74% coverage · 6h".
  • No runtime data
• Vulnerability detail (sca_vulnerability_detail.html): sessions, app/env, routes with auth state, entry frame, stack sample, and the source (sensor or coverage import). Also show version drift when production runs a different version than the one scanned (Runtime package inventory: loaded versions, drift and live advisories #68).
• Priority hint: when the static verdict is Not reachable but the runtime result is Executed or Reached from traffic, highlight the row as a conflict. This is the case the feature exists to catch.
• Overview (sca_dashboard.html): a small "runtime-confirmed reachable" count, split into reached from traffic and executed.

Where to look: src/secfoo/web/sca_dashboard.py, the templates above, design-system/ for components. Use the existing severity and status styling, not new colors.

Done when: web tests (see tests/test_web/) cover every runtime state and the conflict highlight, and a screenshot goes in the PR.