Save scan findings to cora.db - fix scan history gap #398

Problem

cora scan has zero history persistence:

• No call to save_snapshot() (confirmed: 0 references in scan.rs)
• No .cora/history/*.json file created
• No DB persistence

After a scan, results are printed to stdout and completely lost.

Solution

Same pattern as review (#397) but for scan.

Changes

1. src/commands/scan.rs — After printing results:

   • Call DebtSnapshot::from_review() to save legacy JSON
   • Call save_review_to_db() to persist to cora.db with command="scan"

2. Reuse db_writer.rs from Save review findings to cora.db (v5 tables) #397

Key Difference from Review

Dependencies

• Depends on: Rename graph.db → cora.db with auto-migrate #395 (cora.db), Migration v5: reviews, findings, finding_events tables #396 (v5 schema), Save review findings to cora.db (v5 tables) #397 (db_writer module)

Acceptance Criteria

• Every cora scan run creates 1 row in reviews + N rows in findings
• .cora/history/*.json also created
• cora debt CLI shows scan history alongside review history
• cora scan --format sarif still outputs SARIF to stdout
• No regression in scan performance