cora findings CLI - list, dismiss, reopen, stats #400

Problem

Once findings are stored in cora.db (#396, #397, #398), users need a CLI to query and manage them. Without this, the data is write-only — you can populate the DB but cannot view or act on findings.

Solution

New cora findings subcommand for listing, filtering, and managing finding status.

Commands

# List findings (default: open only)
cora findings list
cora findings list --status open
cora findings list --status solved
cora findings list --status false_positive
cora findings list --severity critical,major
cora findings list --file "src/auth/**"
cora findings list --since 2026-07-01
cora findings list --review <review_id>

# Show finding detail
cora findings show <finding_id>

# Dismiss a finding
cora findings dismiss <finding_id> --reason false_positive
cora findings dismiss <finding_id> --reason wontfix --note "Expected behavior"

# Reopen a finding
cora findings reopen <finding_id>

# Summary / stats
cora findings stats
cora findings stats --by-file
cora findings stats --by-severity

Output Format

$ cora findings list

  ID       SEVERITY  FILE                        LINE  STATUS   REVIEW
  f3a1b2c  critical  src/auth/login.rs           42    open     r8d7e6f
  f4c5d6e  major     src/db/query.rs             128   open     r8d7e6f
  f5e7f8a  minor     src/utils/logger.rs         8     solved   r7c6d5e
  f6a8b9c  info      src/main.rs                 15    open     r8d7e6f

  4 findings (3 open, 1 solved)

Dependencies

• Depends on: Migration v5: reviews, findings, finding_events tables #396 (v5 schema), Save review findings to cora.db (v5 tables) #397 (findings in DB)

Acceptance Criteria

• cora findings list shows all findings with filtering
• cora findings show <id> displays full detail (body, suggested_fix, events)
• cora findings dismiss <id> --reason <reason> updates status + creates event
• cora findings reopen <id> reopens and creates event
• cora findings stats shows summary (count by severity/status/file)
• --format json support for all subcommands
• Cross-project queries work (filter by project)