Save review findings to cora.db (v5 tables) #397

Problem

cora review currently only saves a DebtSnapshot (aggregate counts) to .cora/history/*.json. The full ReviewResponse with per-finding detail is only printed to stdout and lost.

Solution

After every review, persist full results to the reviews + findings tables (from #396 migration v5).

Changes

1. src/commands/review.rs — After save_snapshot(), also:

   • Generate UUID v7 for review
   • INSERT into reviews table (project_id, command="review", commit, branch, quality_score, gate_status, files_scanned, lines_scanned, provider, model, tokens, cost, duration, summary)
   • For each ReviewIssue: INSERT into findings with computed fingerprint
   • Fix hardcoded files_reviewed: 0 (line 299 — populate from actual diff file count)

2. New module: src/engine/db_writer.rs — Encapsulate DB write logic:

   pub fn save_review_to_db(
       conn: &Connection,
       project_id: i64,
       command: &str,
       commit: Option<&str>,
       branch: Option<&str>,
       files_scanned: usize,
       lines_scanned: Option<usize>,
       duration_ms: Option<u64>,
       response: &ReviewResponse,
       llm_config: &LLMConfig,
   ) -> anyhow::Result<String> // returns review_id

3. Fingerprint computation:

   fn finding_fingerprint(file: &str, line: Option<u32>, title: &str) -> String {
       // Normalize: lowercase title, strip non-alphanumeric
       // Hash: sha256(file:line:normalized_title)
       use std::hash::{Hash, Hasher};
       let mut h = std::collections::hash_map::DefaultHasher::new();
       format!("{}:{}:{}", file, line.unwrap_or(0), title.to_lowercase()).hash(&mut h);
       format!("{:016x}", h.finish())
   }

Data Flow

cora review --staged
  │
  ├── LLM call → ReviewResponse
  ├── DebtSnapshot → .cora/history/*.json (existing, keep)
  └── NEW: save_review_to_db() → cora.db
        ├── INSERT reviews
        └── INSERT findings (per issue)

Dependencies

• Depends on: Rename graph.db → cora.db with auto-migrate #395 (cora.db), Migration v5: reviews, findings, finding_events tables #396 (v5 schema)

Acceptance Criteria

• Every cora review run creates 1 row in reviews + N rows in findings
• fingerprint is deterministic (same finding = same hash)
• files_reviewed is accurate (not hardcoded 0)
• cora review --format json stdout unchanged
• .cora/history/*.json still written (backward compat)
• Works with and without --ci flag