scanner: improve IO handling, defaults and tests

Multiple fixes and enhancements across the scanner, DB, tests, and docs:

- Surface stream read errors immediately in grype/trivy/syft flows to avoid masking I/O failures behind exit-code messages.
- Improve ringBuffer to handle non-positive capacity, preallocate buffer, and copy trailing bytes to allow GC of large backing arrays.
- Use os.OpenFile with explicit flags/mode when writing log files.
- Make parseIntSetting accept a per-setting default, trim and atoi the value, and return the supplied default for missing/malformed/non-positive values; update DB to pass appropriate defaults.
- Introduce package-level heartbeatTickInterval (default 5s) so tests can shorten the cadence; update heartbeat tests to use a helper and assert progress behavior.
- Test and test helper fixes: countingWriter, file writes check errors, additional assertions, and strengthened manager_test to exercise each env var separately.
- Frontend tests updated for explicit ScannerConfig typing, rename pollInterval to pollIntervalMinutes, add onNewCVEs notification flag, and minor expectations adjustments.
- README: correct docker image reference.

These changes improve error visibility, resource handling, test robustness, and tighten parsing of numeric settings.

frontend/src/features/scanner/api/scanner-config.test.ts

@@ -1,5 +1,6 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 
+import type { ScannerConfig } from "../types";
 import { getScannerConfig, testScanNotification, updateScannerConfig } from "./scanner-config";
 
 vi.mock("@/lib/api-client", () => ({
@@ -27,19 +28,20 @@ function errResponse(status: number, msg: string): Response {
   } as unknown as Response;
 }
 
-const sampleConfig = {
+const sampleConfig: ScannerConfig = {
   grypeImage: "anchore/grype:v0.110.0",
   trivyImage: "aquasec/trivy:0.69.3",
   syftImage: "anchore/syft:v1.27.1",
-  defaultScanner: "grype" as const,
+  defaultScanner: "grype",
   grypeArgs: "",
   trivyArgs: "",
   notifications: {
     onScanComplete: true,
     onBulkComplete: true,
-    minSeverity: "High" as const,
+    onNewCVEs: true,
+    minSeverity: "High",
   },
-  autoScan: { enabled: false, pollInterval: 15 },
+  autoScan: { enabled: false, pollIntervalMinutes: 15 },
   forceRescan: false,
   scanTimeoutMinutes: 20,
   bulkTimeoutMinutes: 120,
@@ -72,7 +74,7 @@ describe("updateScannerConfig", () => {
   afterEach(() => vi.clearAllMocks());
 
   it("sends a PUT request with the config and returns updated config", async () => {
-    const updatedConfig = { ...sampleConfig, defaultScanner: "trivy" as const };
+    const updatedConfig: ScannerConfig = { ...sampleConfig, defaultScanner: "trivy" };
     mockFetch.mockResolvedValueOnce(okResponse({ config: updatedConfig }));
 
     const result = await updateScannerConfig(updatedConfig);