feat: remove legacy frontend, root routing, compliance ZIP with Chromium PDF, chat markdown styling

- Legacy frontend removed: React SPA served at / (no /app/ prefix)
- Compliance report ZIP: Chromium headless --print-to-pdf (identical to browser) + CSV findings
- Server-side generation state: .compliance_generating marker survives page navigation
- RAG enriched: Description + Rationale + Remediation + Audit extracted from CIS vector chunks
- Chat markdown: syntax highlighting (Catppuccin), styled headings/lists/tables/blockquotes/code
- Default model auto-selected on Chat Agent load

frontend-react/src/api/client.ts

@@ -20,7 +20,7 @@ client.interceptors.response.use(
   (err) => {
     if (err.response?.status === 401) {
       localStorage.removeItem('t');
-      window.location.href = '/app/login';
+      window.location.href = '/login';
     }
     const detail = err.response?.data?.detail || err.response?.data?.message || err.message || 'Erro';
     return Promise.reject(new Error(detail));

frontend-react/src/api/endpoints/reports.ts

@@ -109,7 +109,12 @@ export const reportsApi = {
     client.post(`/reports/${rid}/compliance-report/generate`) as unknown as Promise<{ status: string; has_rag: boolean }>,
 
   complianceReportStatus: (rid: string) =>
-    client.get(`/reports/${rid}/compliance-report/status`) as unknown as Promise<{ ready: boolean }>,
+    client.get(`/reports/${rid}/compliance-report/status`) as unknown as Promise<{ ready: boolean; generating: boolean }>,
+
+  complianceReportZipUrl: (rid: string) => {
+    const token = localStorage.getItem('t') || '';
+    return `/api/reports/${rid}/compliance-report/download?token=${encodeURIComponent(token)}`;
+  },
 
   files: (rid: string) =>
     client.get(`/reports/${rid}/files`) as unknown as Promise<ReportFile[]>,