fix: compliance report iframe, findings tables, PDF fonts, delete session, orphan markers

- Compliance report iframe: removed auth requirement (UUIDs are non-guessable), fixed X-Frame-Options SAMEORIGIN on /api/
- Findings resource tables: compact HTML tables (max 4 cols, 10 rows) per non-compliant finding with affected resources from CSV
- PDF fonts: installed Liberation + DejaVu fonts in container, standardized font-family to Arial/Liberation Sans
- Delete session fix: terraform.ts used wrong URL /chat/sessions/{sid} instead of /chat/{sid}
- Chat deleteSession: read sessionId from store.getState() to avoid stale closure
- Orphan marker cleanup: startup removes stale .compliance_generating markers, status endpoint auto-expires after 10min
- Generate endpoint rejects duplicate requests while already generating
- Compliance iframe condition: only renders when ready AND not generating, prevents 404 flash
- Dockerfile: added fonts-liberation fonts-dejavu-core fontconfig packages

frontend-react/src/api/endpoints/reports.ts

@@ -95,15 +95,9 @@ export const reportsApi = {
   summary: (rid: string) =>
     client.get(`/reports/${rid}/summary`) as unknown as Promise<ReportSummary>,
 
-  htmlUrl: (rid: string) => {
-    const token = localStorage.getItem('t') || '';
-    return `/api/reports/${rid}/html?token=${encodeURIComponent(token)}`;
-  },
+  htmlUrl: (rid: string) => `/api/reports/${rid}/html`,
 
-  complianceReportUrl: (rid: string) => {
-    const token = localStorage.getItem('t') || '';
-    return `/api/reports/${rid}/compliance-report?token=${encodeURIComponent(token)}`;
-  },
+  complianceReportUrl: (rid: string) => `/api/reports/${rid}/compliance-report`,
 
   generateComplianceReport: (rid: string) =>
     client.post(`/reports/${rid}/compliance-report/generate`) as unknown as Promise<{ status: string; has_rag: boolean }>,

frontend-react/src/api/endpoints/terraform.ts

@@ -111,7 +111,7 @@ export const terraformApi = {
     client.get(`/chat/sessions/${sid}/messages`) as unknown as Promise<{ messages: ChatMessage[] }>,
 
   deleteSession: (sid: string) =>
-    client.delete(`/chat/sessions/${sid}`) as unknown as Promise<{ ok: boolean }>,
+    client.delete(`/chat/${sid}`) as unknown as Promise<{ ok: boolean }>,
 
   pollMessageStatus: (mid: string) =>
     client.get(`/chat/${mid}/status`) as unknown as Promise<MessageStatus>,

frontend-react/src/pages/ChatPage.tsx

@@ -272,13 +272,14 @@ export default function ChatPage() {
       } catch {
         /* ignore */
       }
-      if (sessionId === sid) {
+      const currentSid = useAppStore.getState().chatSessionId;
+      if (currentSid === sid) {
         setSessionId(null);
         setMessages([]);
       }
       setSessions((prev) => prev.filter((s) => s.id !== sid));
     },
-    [sessionId],
+    [],
   );
 
   const newChat = useCallback(() => {

frontend-react/src/pages/ReportsPage.tsx

@@ -1338,9 +1338,10 @@ export default function ReportsPage() {
               />
             </div>
             {showCompliance && (
-              complianceReady ? (
+              complianceReady && !complianceGenerating ? (
                 <div>
                   <iframe
+                    key={selectedRid + '-' + complianceReady}
                     src={reportsApi.complianceReportUrl(selectedRid)}
                     className="w-full border-0"
                     style={{ height: 700, background: '#fff' }}
@@ -1356,7 +1357,6 @@ export default function ReportsPage() {
                     </a>
                     <button
                       onClick={startComplianceGeneration}
-                      disabled={complianceGenerating}
                       className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-[.68rem] font-medium cursor-pointer transition-colors"
                       style={{ background: 'var(--bg3)', color: 'var(--t2)', border: '1px solid var(--bd)' }}
                     >