feat(graph): [3/3] path traversal, scoring, API endpoints, and tests

[TFT444]

Objective

Walk the populated graph to produce one prioritised attack path per scan,
expose it via API, and prove the full pipeline with integration tests.

Depends on: #332

Scope

Path traversal (scanner/graph/path_finder.py)

• BFS from high-risk entry points (public IPs, internet-exposed NSGs)
  to sensitive targets (storage, key vaults, databases with findings)
• Prune edges with confidence < 0.5
• Score by: finding severity on nodes, toxic-combination multiplier
  (public exposure + overprivileged identity + sensitive data in one path),
  path length penalty, and confidence product across edges
• Persist top-N paths in new attack_paths table (new Alembic migration)
• Paths are immutable; new scans produce new paths

API (api/routes/attack_graph.py)

• GET /api/v1/scans/{scan_id}/attack-graph (nodes and edges)
• GET /api/v1/scans/{scan_id}/attack-paths (ranked paths with evidence)
• GET /api/v1/attack-paths/{path_id} (single path, full detail)
• Tenant isolation enforced on all three endpoints

Docs

• Update docs/api-reference.md with the three new endpoints
• Update docs/architecture.md with the attack graph pipeline

Test plan

• Toxic combination scores higher than isolated findings
• Empty graph returns no paths (200 OK)
• GET endpoints return correct shape
• Integration test: scan trigger -> nodes -> edges -> path in one flow
• Docs updated