feat(graph): [1/3] attack graph foundation - DB schema and ARG rule migration

Objective

Lay the two foundations the rest of the attack graph depends on:
the DB schema and the ARG-based scan data pipeline.

Scope

DB schema (Alembic migration)

• graph_nodes: node_id, tenant_id, subscription_id, resource_id,
  resource_type, name, location, resource_group, snapshot_id,
  properties (JSONB), created_at, updated_at
• graph_edges: edge_id, source_node_id, target_node_id,
  relationship_type, evidence_source, evidence_snapshot_id,
  confidence (float), collected_at, properties (JSONB)
• finding_graph_nodes: finding_id, node_id (links findings to nodes)

ARG rule migration (scanner/engine.py + scanner/rules/)

• Collect one InventorySnapshot per subscription at scan start
• Update RuleBase signature to evaluate(snapshot, client)
  where snapshot is primary and client is for SDK enrichment only
• Migrate all rules in scanner/rules/ to read from snapshot.resources
• Comment any rule still requiring a direct SDK call

Test plan

• Migration applies and rolls back cleanly
• All existing rule tests pass with new interface
• End-to-end scan time recorded in PR description
• No regression in finding counts vs old SDK path