feat: Multi-tab report structure (Security Findings, OWASP Top 10, FinServ, Service-wise)

## Summary

As the number of checks grows past 116, the single-page report becomes overwhelming for different stakeholder audiences. A tabbed layout would let security engineers, compliance teams, and executives each land on the view most relevant to them.

## Proposed Tab Structure

| Tab | Audience | Content |
|---|---|---|
| **Overview** | Executives | Current executive dashboard and priority recommendations |
| **Security Findings** | Security engineers | All findings with existing filters (current table) |
| **OWASP LLM Top 10** | AppSec / Developers | Findings mapped to OWASP LLM Top 10 categories |
| **FinServ / Compliance** | Risk & Compliance | Financial services and compliance-specific checks |
| **Service-wise** | Cloud engineers | Findings grouped by AWS service (Bedrock, SageMaker, AgentCore, etc.) |

## Files Likely Touched

- HTML report template in the `generate_consolidated_report` Lambda function — restructure into tabbed layout
- Existing check data will need an `owasp_category` field to populate the OWASP tab (see #34 for metadata groundwork)

## Acceptance Criteria

- [ ] Report renders with a tab bar; each tab shows a filtered/grouped subset of findings
- [ ] All existing filters (severity, status, account) continue to work within each tab
- [ ] Tabs degrade gracefully when a category has zero findings (show an empty state, not a broken layout)
- [ ] Dark/light mode toggle applies across all tabs
- [ ] CSV export structure is unchanged (tabs are UI-only)

## Dependencies

- #34 (metadata fields) — needed to populate OWASP and FinServ tab filters correctly
- #35 (NIST AI RMF / ISO 42001) — compliance tab benefits from framework mappings

Start with the HTML report template in the generate_consolidated_report Lambda and review the metadata work in #34 and framework mappings in #35. Implement the tab structure while preserving severity, status, and account filters, dark/light mode, empty states, and the existing CSV export. Done means all acceptance criteria work across the proposed tabs.

Written by the indexing model from the issue text.