feat(report): add a fix-available-only filter to HTML reports

[vibgrate-team]

Summary

vg report --format html showed every finding, so long pages buried the rows that already name a fixed version. Each row was already stamped data-fix-available="yes" or "no" from details.fixedVersions on the scan artifact, but the page had no control to show only the rows with a known fix.

The summary now includes an unchecked Fix available only checkbox. Checking it hides table rows whose data-fix-available attribute is no. The generated HTML still contains every row, so a fixed artifact stays byte-stable and the default view is unchanged. The filter is a style rule in the page: no script, no external assets, and no registry call at report time. Summary counts stay complete.

Related issues

Closes #249

How to verify

1. pnpm test, pnpm lint, and pnpm typecheck.
2. Render a scan artifact: pnpm dev report --in .vibgrate/scan_result.json --format html > report.html.
3. Open report.html. Every finding is visible. Check Fix available only and confirm rows without a known fix disappear. Uncheck it and confirm they return. The file on disk does not change.

Unchecked, every row is on the page:

HTML report with the fix-available-only checkbox unchecked and every row visible

Checked, rows with no known fix are hidden. The summary count stays Fix available: 2:

HTML report filtered to rows that name a known fix

html-fix-available-only-filter.mp4

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed
• Determinism preserved — identical input still produces identical graph.json / report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

The control is CSS (body:has(#fix-available-only:checked) tr[data-fix-available="no"]), so the page still has no embedded script. A row is yes only when the existing fix hint finds a non-empty details.fixedVersions list already on the artifact. Security findings stay data-fix-available="no" and hide while the box is checked.

_{To show artifacts inline, enable in settings.}