feat: implement audit detail page with findings view (#32)

- API: Add PATCH /audits/findings/:id endpoint for finding status updates
  - Validates status against allowed values (OPEN, ACKNOWLEDGED, etc.)
  - Enforces authorization (user must own the audit)

- Web: Create reusable audit components
  - FindingCard: expandable card with status selector, code display, AI summary
  - FindingList: findings with search, severity/status/plugin filters
  - SeverityChart: pie chart showing severity distribution via recharts

- Web: Rewrite audit detail page with real API integration
  - Fetches audit + findings from API with loading/error/empty states
  - Stats grid showing security score, status, findings count, duration
  - Optimistic status updates with revert on failure
  - Active 'Verify on-chain' button with placeholder
  - Link to AI Chat for contextual questions

- Web: Improve audit list page
  - Real API integration with status filtering and search
  - Links to detail pages
  - Proper loading, empty, and error states

- Web: Extract shared API helpers to lib/api-helpers.ts

Author: Emmanuel-Ugochukwu1

apps/api/src/modules/audits/audits.controller.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/common';
+import { Body, Controller, Get, Param, Patch, Post, Query, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 
 import { CurrentUser } from '../../common/decorators/current-user.decorator';
@@ -30,4 +30,14 @@ export class AuditsController {
   findOne(@Param('id') id: string, @CurrentUser('id') userId: string) {
     return this.auditsService.findOne(id, userId);
   }
+
+  @Patch('findings/:id')
+  @ApiOperation({ summary: 'Update finding status' })
+  updateFindingStatus(
+    @Param('id') id: string,
+    @Body() body: { status: string },
+    @CurrentUser('id') userId: string,
+  ) {
+    return this.auditsService.updateFindingStatus(id, body.status, userId);
+  }
 }

apps/api/src/modules/audits/audits.service.ts

@@ -1,4 +1,4 @@
-import { ForbiddenException, Injectable, NotFoundException } from '@nestjs/common';
+import { BadRequestException, ForbiddenException, Injectable, NotFoundException } from '@nestjs/common';
 import { logger } from '@veridion/logger';
 
 import { PrismaService } from '../../common/prisma/prisma.service';
@@ -72,4 +72,32 @@ export class AuditsService {
 
     return audit;
   }
+
+  async updateFindingStatus(findingId: string, status: string, userId: string) {
+    const validStatuses = ['OPEN', 'ACKNOWLEDGED', 'FALSE_POSITIVE', 'RESOLVED'];
+    if (!validStatuses.includes(status)) {
+      throw new BadRequestException(
+        `Invalid status. Must be one of: ${validStatuses.join(', ')}`,
+      );
+    }
+
+    const finding = await this.prisma.db.auditFinding.findUnique({
+      where: { id: findingId },
+      include: { audit: { include: { project: { select: { userId: true } } } } },
+    });
+
+    if (!finding) throw new NotFoundException('Finding not found');
+    if (finding.audit.project.userId !== userId) {
+      throw new ForbiddenException('Access denied');
+    }
+
+    const updated = await this.prisma.db.auditFinding.update({
+      where: { id: findingId },
+      data: { status },
+    });
+
+    logger.info({ findingId, status, userId }, 'Finding status updated');
+
+    return updated;
+  }
 }