Add a standalone --html report output

[JTP75]

Description

vettd's only report outputs today are machine-readable JSON and colorized terminal text. There's no standalone, shareable report artifact a human can open or attach to a build without a terminal. A competitive scan against another AI-artifact scanner (stoa) showed this gap concretely: stoa's --html output produces a self-contained styled report (summary cards, per-finding detail, severity badges) suitable for archiving as a CI artifact or sharing with a reviewer; vettd has no equivalent.

Scope

• A new output flag (e.g. --html <FILE>) on the folder/repo/file scan subcommands that renders a self-contained static HTML report from the same finding data already produced for JSON output.
• Report should surface the same severity/risk/reasoning detail currently only visible in terminal output (risk score breakdown, capability tags, contributing signals) in a browsable form.

Acceptance Criteria

• --html <FILE> writes a self-contained (no external asset fetches) HTML report
• Report includes a summary section (counts by severity) and per-finding detail (path, severity, reasoning/signals)
• Works for scan folder, scan repo, and scan file
• Covered by a smoke test verifying the file is written and contains expected sections