[FIX 2] Reliability: score endpoint 500, DB pooling, CVE timeout, query safety, thread safety

[TFT444]

Objective

Fix the five reliability findings from the codebase audit.

Findings addressed

• REL-001 CRITICAL: Duplicate GROUP BY causes /api/score to always return HTTP 500, fix the query
• REL-002 MEDIUM: Fragile INTERVAL '%s minutes' psycopg2 substitution, use safe parameterisation
• REL-003 MEDIUM: New PostgreSQL connection per request, add connection pooling
• REL-004 MEDIUM: Synchronous CVE enrichment times out on large scans, make it async or batched
• REL-005 LOW: NVD rate-limit guard not thread-safe, add a lock

Acceptance criteria

• /api/score returns 200 with correct data
• Interval query uses safe parameterisation
• Connection pooling in place
• Large scans no longer timeout on CVE enrichment
• NVD rate-limit guard is thread-safe
• CI passes, base branch dev

Category

Reliability