fix(app): enforce report-backed quarantine safety

[alexsmolya]

Fixes #84

Quarantine previously re-classified a finding with rules-only context, which could weaken the graph-aware verdict shown in the completed report and allow a risky file through the backend command.

This fix makes the completed backend report authoritative for the exact finding under review:

• frontend verdict/category/score data is not trusted or accepted as authority;
• fresh static rules can tighten the report verdict, but never relax it;
• generation-scoped report authority prevents superseded scans from retaining quarantine authorization;
• quarantine requires the exact finding path and checks target metadata without using fragile access-time evidence;
• missing, stale, or unauthorized findings fail closed, while legitimate Safe/Review findings remain quarantinable.

The bounded contract is intentional: a completed scan report is the reviewed snapshot, and starting a new scan invalidates the old authority. This change does not claim platform-level filesystem object identity or eliminate every OS-level path TOCTOU window.