feat: pure Dioxus attack chain visualization, PDF report redesign, and orchestrator data fixes

- Replace vis-network JS graph with pure RSX attack chain component
  featuring KPI header, phase rail, expandable accordion with tool
  category chips, risk scores, and findings pills
- Redesign pentest report as professional PDF-first document with
  cover page, table of contents, severity bar chart, phased attack
  chain timeline, and print-friendly light theme
- Fix orchestrator to populate findings_produced, risk_score, and
  llm_reasoning on attack chain nodes
- Capture LLM reasoning text alongside tool calls in LlmResponse enum
- Add session-level KPI fallback for older pentest data
- Remove attack-chain-viz.js and prototype files
- Add encrypted ZIP report export endpoint with password protection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/features/dast.md

@@ -67,7 +67,7 @@ Navigate to **DAST > Findings** to see all discovered vulnerabilities. Each find
 
 | Column | Description |
 |--------|-------------|
-| Severity | Critical, High, Medium, or Low |
+| Severity | Critical, High, Medium, Low, or Info |
 | Type | Vulnerability category (SQL Injection, XSS, SSRF, etc.) |
 | Title | Description of the vulnerability |
 | Endpoint | The HTTP path that is vulnerable |
@@ -76,6 +76,19 @@ Navigate to **DAST > Findings** to see all discovered vulnerabilities. Each find
 
 Click a finding to see full details including the CWE identifier, vulnerable parameter, remediation guidance, and evidence showing the exact request/response pairs that triggered the finding.
 
+### Filtering Findings
+
+The findings page provides several filters to help you focus on what matters:
+
+| Filter | Description |
+|--------|-------------|
+| **Search** | Free-text search across finding titles and descriptions |
+| **Severity** | Filter by severity level (Critical, High, Medium, Low, Info) |
+| **Vulnerability Type** | Filter by vulnerability category -- supports all 21 DAST vulnerability types including SQL Injection, XSS, SSRF, CORS Misconfiguration, CSP Bypass, and more |
+| **Exploitable** | Show only confirmed-exploitable findings, or only unconfirmed |
+
+Filters can be combined. A count indicator shows how many findings match the current filters out of the total (e.g. "Showing 12 of 76 findings"). When no findings match the active filters, a message distinguishes between "no findings exist" and "no findings match your current filters."
+
 ::: tip
 Findings marked as **Confirmed** exploitable were verified with a successful attack payload. **Unconfirmed** findings show suspicious behavior that may indicate a vulnerability but could not be fully exploited.
 :::