feat(graph): [3/3] path traversal, scoring, API endpoints, and tests

Objective

Walk the populated graph to produce one prioritised attack path per scan,
expose it via API, and prove the full pipeline with integration tests.

Depends on: #332

Scope

Path traversal (scanner/graph/path_finder.py)

• BFS from high-risk entry points (public IPs, internet-exposed NSGs)
  to sensitive targets (storage, key vaults, databases with findings)
• Prune edges with confidence < 0.5
• Score by: finding severity on nodes, toxic-combination multiplier
  (public exposure + overprivileged identity + sensitive data in one path),
  path length penalty, and confidence product across edges
• Persist top-N paths in new attack_paths table (new Alembic migration)
• Paths are immutable; new scans produce new paths

API (api/routes/attack_graph.py)

• GET /api/v1/scans/{scan_id}/attack-graph (nodes and edges)
• GET /api/v1/scans/{scan_id}/attack-paths (ranked paths with evidence)
• GET /api/v1/attack-paths/{path_id} (single path, full detail)
• Tenant isolation enforced on all three endpoints

Docs

• Update docs/api-reference.md with the three new endpoints
• Update docs/architecture.md with the attack graph pipeline

Test plan

• Toxic combination scores higher than isolated findings
• Empty graph returns no paths (200 OK)
• GET endpoints return correct shape
• Integration test: scan trigger -> nodes -> edges -> path in one flow
• Docs updated