[WM-BW-6] POA&M items have no structural link to source findings (SP 800-37)

## WM-BW-6 — POA&M Finding Source Traceability Missing

**Category:** Broken ATO/RMF Workflow | **Priority:** High
**Regulation:** SP 800-37

### Observation
POA&M items have no structural link to their source findings (SAR findings, STIG results, scan results). SP 800-37 requires POA&M items trace to their finding source. Additionally, POA&M items have been observed attributed to the wrong system entirely.

### Evidence
- Issue #571 — POA&M attributed to wrong system
- Issue #629 — POA&M sub-page blank

### Impact
POA&M items cannot be validated against their source findings. Wrong-system attribution means remediation tracking is unreliable and misleading.

### Acceptance Criteria
- [ ] POA&M item record includes FK to source finding (SAR finding, STIG result, or scan result)
- [ ] Finding source type and ID displayed on POA&M item
- [ ] Fix system-attribution bug (ref #571)
- [ ] Fix POA&M sub-page blank (ref #629)
- [ ] POA&M export includes source finding references