fix(rules): apply max_findings after suppression and report dropped findings (#624)

[ajianaz]

What

• rules_engine.max_findings is now enforced once, in engine::postprocess (new postprocess_report returning { issues, dropped }; postprocess kept), AFTER ignore.rules and cora-ignore, on deterministic findings only (those with a rule_id; LLM issues are never capped). Highest severity kept first, stable order.
• Scanners (secrets, security, index scanners, rule engine) run uncapped (usize::MAX) from deterministic::run, postprocess (Files) and cora scan; their max_findings params are unchanged.
• cora scan / cora review print one stderr line when findings are cut (⚠ N more deterministic findings not shown (rules.max_findings = 5; raise it or set 0/null to show all)); the cora scan summary mentions it. ReviewResponse.dropped_findings is #[serde(skip)], so JSON/SARIF/compact stdout is unchanged.
• max_findings: 0 or null = unlimited (finding_cap()); null now deserializes in .cora.yaml.
• Docs (docs/configuration.md) and CHANGELOG updated.

Why

The cap was applied inside each scanner before suppression and truncated silently, so suppressed findings used up slots and hid real ones (5 marked lines hid the 6th real secret), with no message. Blocking is unaffected for any cap >= 1 because the most severe findings are kept first.

Testing

• New unit tests: severity ordering, stable order, dropped count, LLM issues never capped, 0/null/default semantics, warning text, Source::Files and Source::Diff (5 suppressed + 1 real reports the real one). Temp dirs only.
• fmt, clippy -D warnings, full cargo test 3x green.
• Real binary (temp repo, temp CODECORA_HOME, LLM unreachable): 8 secrets -> 5 shown + stderr warning with count 3; 5 cora-ignored + 1 real -> real one reported, no warning; max_findings: 0 -> all 9 shown; review --staged compact/json valid.

Closes #624

🤖 Generated with Claude Code