feat: show affected device identity on risk cards (#40)

[reloadfast]

Closes #40

Changes

Backend — backend/app/api/__init__.py

• Added ip_address and hostname fields to RiskOut schema
• Updated all three risk query paths (list_risks, get_risk, device_risks) to eagerly load Risk.device via selectinload — eliminates N+1 queries

Frontend — frontend/src/types/api.ts

• Added ip_address: string and hostname: string | null to the Risk interface

Frontend — frontend/src/pages/RisksPage.tsx

• Risk list rows now show hostname (preferred) or ip_address as a clickable link to /devices/:id
• Risk detail modal shows hostname/IP as a link instead of "Device #id"
• Removed per-row client-side device lookup (no more devices.find(...) in the list)

Tests — backend/tests/test_api.py

• Updated test_risk_schema_fields to assert ip_address and hostname keys are present
• Added test_risk_includes_device_identity asserting ip_address matches the seeded device