feat(web): ingest CT-CVE finding batches

[simonjcarr]

Summary

• Add signed POST /api/integrations/ct-cve/v1/finding-batches ingestion for CT-CVE finding deliveries.
• Validate contract payloads, enforce body-size/rate limits, reject invalid host/package references, and upsert imported CVE/finding rows with CT-CVE batch metadata.
• Update the CT-CVE migration plan with the Phase 9 slice and remaining connector work.

Validation

• node --experimental-strip-types --test lib/integrations/ct-cve/finding-ingest.test.mjs
• pnpm --filter web type-check
• pnpm --filter web lint -- app/api/integrations/ct-cve/v1/finding-batches/route.ts lib/integrations/ct-cve/finding-ingest.ts lib/integrations/ct-cve/finding-ingest.test.mjs
• pnpm --filter web db:validate
• pnpm --filter web test:unit

Related follow-up

• Investigated CT-CVE release/GHCR publishing before opening this PR. Root cause is tracked in carrtech-dev/ct-cve#9: the CT-CVE default branch is feat/bootstrap-service, while the release workflow only triggers on main, and main does not contain the release workflow or later CT-CVE work.