fix: аудит — 19 фиксов безопасности, надёжности, UI и 16 новых тестов

- S4: bump jinja2>=3.1.4, python-multipart>=0.0.18, httpx>=0.28.0
- S5: _detect_ecosystem — DEFAULT_ECOSYSTEM для неизвестных форматов
- S6: harvester — log.exception() вместо log.error()
- S8: _scan_component — urlencode параметров
- P1: scanner — proc.kill() при таймауте
- P3: api_packages — selectinload(Scan.findings), убран N+1
- P4+P5: утечка _url_locks и _llm_locks при early return
- P6: DB reaper — сброс {'status':'analyzing'} при старте
- UI: htmx-пагинация, фильтры не теряют flagged, 404 с layout
- UI: мобильные таблицы overflow-x, полная стата на дашборде
- UI: i18n статусов в _status_badge, urlencode package_name
- 16 новых тестов: analyze endpoint (6), scanner errors (4),
  webhook signature (2), llm client (4)

guarddog_nexus/routes/web.py

@@ -41,7 +41,8 @@ _jinja_env.globals["config"] = config
 
 def _render(name: str, **context) -> HTMLResponse:
     template = _jinja_env.get_template(name)
-    return HTMLResponse(template.render(**context))
+    status_code = context.pop("_status_code", 200)
+    return HTMLResponse(template.render(**context), status_code=status_code)
 
 
 @router.get("/", response_class=HTMLResponse)
@@ -104,18 +105,14 @@ async def scans_list(
 
 
 @router.get("/scans/{scan_id}", response_class=HTMLResponse)
-async def scan_detail(
-    scan_id: int, request: Request, session: AsyncSession = Depends(get_session)
-):
+async def scan_detail(scan_id: int, request: Request, session: AsyncSession = Depends(get_session)):
     from sqlalchemy.orm import selectinload
 
     scan = await session.scalar(
-        select(Scan)
-        .where(Scan.id == scan_id)
-        .options(selectinload(Scan.findings))
+        select(Scan).where(Scan.id == scan_id).options(selectinload(Scan.findings))
     )
     if not scan:
-        return HTMLResponse(f"<h1>{_t('not_found', request.state.lang)}</h1>", status_code=404)
+        return _render("404.html", request=request, _status_code=404)
 
     return _render("scan_detail.html", scan=scan, request=request)
 
@@ -192,7 +189,7 @@ async def package_detail(
     )
 
     if not scans:
-        return HTMLResponse(f"<h1>{_t('not_found', request.state.lang)}</h1>", status_code=404)
+        return _render("404.html", request=request, _status_code=404)
 
     all_findings = []
     for s in scans:
@@ -223,9 +220,7 @@ async def analyze_finding_htmx(
 
     if not config.llm_enabled:
         msg = _t("llm_disabled", lang)
-        return HTMLResponse(
-            f'<div class="llm-actions"><small class="flagged">{msg}</small></div>'
-        )
+        return HTMLResponse(f'<div class="llm-actions"><small class="flagged">{msg}</small></div>')
 
     finding = await session.scalar(select(Finding).where(Finding.id == finding_id))
     if not finding:
@@ -252,6 +247,8 @@ async def analyze_finding_htmx(
 
     lock = _llm_locks[finding_id]
     if lock.locked():
+        async with _llm_lock:
+            _llm_locks.pop(finding_id, None)
         return _render("_llm_spinner.html", request=request)
 
     async with lock:
@@ -267,9 +264,7 @@ async def analyze_finding_htmx(
         finding.report = None
         await session.commit()
         msg = _t("llm_failed", lang)
-        return HTMLResponse(
-            f'<div class="llm-actions"><small class="flagged">{msg}</small></div>'
-        )
+        return HTMLResponse(f'<div class="llm-actions"><small class="flagged">{msg}</small></div>')
 
     finding.report = report
     await session.commit()