Feature gap: findings.suggested_fix always NULL for rule-based findings #404

Problem

findings.suggested_fix is always NULL for rule-based findings. The body field has a description, but no actionable fix suggestion.

Current State

findings table:
  body = "Static security scanner detected: SQL injection via string concatenation in src/engine/db_writer.rs:80"
  suggested_fix = NULL

Expected

For deterministic rule-based findings, suggested_fix should contain a brief fix suggestion (e.g., "Use parameterized queries instead of string concatenation").

Proposed Fix

1. Add fix suggestions to each rule in security_scanner.rs
2. When saving finding to DB, populate suggested_fix from the rule's suggestion template
3. Display in cora findings list output

Impact

• Users get findings but no guidance on how to fix them
• LLM-based reviews do generate suggestions, but rule-based ones do not
• Inconsistent UX between LLM and rule-based findings