Runtime page: sensor health, live activity and alerts #72

Part of #51. Once sensors send live data (#66), users need to see which apps are covered, whether each sensor is healthy, and what changed recently.

New page: Runtime (per project, linked from the project page):

• Apps table: app, environment, sensor version, instances, last heartbeat, events per minute, dropped events, and observation window. Mark a sensor Stale when it has missed 3 heartbeats.
• Coverage: app functions executed vs. total (from the Runtime evidence format, storage and secfoo runtime ingest #53 session lines), and routes seen.
• Recent activity: newly loaded packages, version drift, unscanned dependencies (Runtime package inventory: loaded versions, drift and live advisories #68), new advisories against running versions, and newly reached vulnerable functions. Each row links to its finding.
• Live refresh: poll a small JSON endpoint every 10 s (no websockets needed) while the tab is visible.

Alerts: add an optional webhook ([runtime] alert_webhook in ~/.secfoo/config.toml) that fires on three events: a vulnerable function first Reached from traffic, a new advisory against a running version, and a sensor going stale. The payload holds the finding fingerprint, app, env and a link, and never stack samples.

Where to look: src/secfoo/web/routes/projects.py, src/secfoo/web/sca_dashboard.py, design-system/.

Done when: web tests cover healthy, stale and never-connected sensors and the webhook payload. A screenshot goes in the PR.