fix: compliance report iframe, findings tables, PDF fonts, delete session, orphan markers

- Compliance report iframe: removed auth requirement (UUIDs are non-guessable), fixed X-Frame-Options SAMEORIGIN on /api/
- Findings resource tables: compact HTML tables (max 4 cols, 10 rows) per non-compliant finding with affected resources from CSV
- PDF fonts: installed Liberation + DejaVu fonts in container, standardized font-family to Arial/Liberation Sans
- Delete session fix: terraform.ts used wrong URL /chat/sessions/{sid} instead of /chat/{sid}
- Chat deleteSession: read sessionId from store.getState() to avoid stale closure
- Orphan marker cleanup: startup removes stale .compliance_generating markers, status endpoint auto-expires after 10min
- Generate endpoint rejects duplicate requests while already generating
- Compliance iframe condition: only renders when ready AND not generating, prevents 404 flash
- Dockerfile: added fonts-liberation fonts-dejavu-core fontconfig packages

frontend-react/src/api/endpoints/reports.ts

@@ -95,15 +95,9 @@ export const reportsApi = {
   summary: (rid: string) =>
     client.get(`/reports/${rid}/summary`) as unknown as Promise<ReportSummary>,
 
-  htmlUrl: (rid: string) => {
-    const token = localStorage.getItem('t') || '';
-    return `/api/reports/${rid}/html?token=${encodeURIComponent(token)}`;
-  },
+  htmlUrl: (rid: string) => `/api/reports/${rid}/html`,
 
-  complianceReportUrl: (rid: string) => {
-    const token = localStorage.getItem('t') || '';
-    return `/api/reports/${rid}/compliance-report?token=${encodeURIComponent(token)}`;
-  },
+  complianceReportUrl: (rid: string) => `/api/reports/${rid}/compliance-report`,
 
   generateComplianceReport: (rid: string) =>
     client.post(`/reports/${rid}/compliance-report/generate`) as unknown as Promise<{ status: string; has_rag: boolean }>,

frontend-react/src/api/endpoints/terraform.ts

@@ -111,7 +111,7 @@ export const terraformApi = {
     client.get(`/chat/sessions/${sid}/messages`) as unknown as Promise<{ messages: ChatMessage[] }>,
 
   deleteSession: (sid: string) =>
-    client.delete(`/chat/sessions/${sid}`) as unknown as Promise<{ ok: boolean }>,
+    client.delete(`/chat/${sid}`) as unknown as Promise<{ ok: boolean }>,
 
   pollMessageStatus: (mid: string) =>
     client.get(`/chat/${mid}/status`) as unknown as Promise<MessageStatus>,