feat: remove legacy frontend, root routing, compliance ZIP with Chromium PDF, chat markdown styling

- Legacy frontend removed: React SPA served at / (no /app/ prefix)
- Compliance report ZIP: Chromium headless --print-to-pdf (identical to browser) + CSV findings
- Server-side generation state: .compliance_generating marker survives page navigation
- RAG enriched: Description + Rationale + Remediation + Audit extracted from CIS vector chunks
- Chat markdown: syntax highlighting (Catppuccin), styled headings/lists/tables/blockquotes/code
- Default model auto-selected on Chat Agent load

nginx/default.conf

@@ -5,18 +5,9 @@ server {
     client_max_body_size 50M;
     absolute_redirect off;
 
-    # New React app at /app/
-    location ^~ /app/ {
-        root /usr/share/nginx/html;
-        # Files are in /usr/share/nginx/html/app/ (mapped from dist/)
-        try_files $uri $uri/ /app/index.html;
-        add_header Cache-Control "no-cache, no-store, must-revalidate";
-    }
-
-    # Legacy SPA at /
+    # React SPA at root
     location / {
-        root /usr/share/nginx/html;
-        index index.html;
+        root /usr/share/nginx/html/app;
         try_files $uri $uri/ /index.html;
         add_header Cache-Control "no-cache, no-store, must-revalidate";
     }