Resilience: serve cached CVE search and detail during upstream outages

[rupertgermann]

Parent

#6

What to build

The app already persists every successfully fetched CVE into the local store, but search and CVE detail fail outright when the upstream CIRCL API is down. Add graceful degradation: when an upstream call fails (timeout, 5xx, network error), the vulnerability API layer falls back to the local CVE store. Fallback responses carry a source marker (cache vs live) and the stored-at timestamp, and the search results and CVE detail surfaces render a visible cached-data indicator from that marker so analysts never mistake stale data for live data. Upstream 404s for unknown CVE identifiers are not masked by cache fallback — a genuinely unknown CVE still reads as not found.

Acceptance criteria

• With upstream failing, a CVE detail request for a previously fetched CVE returns the cached record marked as cached with its stored-at timestamp
• With upstream failing, search returns matching results from the local store marked as cached
• With upstream healthy, responses are marked live and behave exactly as before
• An upstream 404 for an unknown CVE still results in not-found, not a cache hit
• The search and CVE detail UI show a cached/stale-data indicator when rendering cached responses
• TDD: behavior covered at the server API / route-handler seams with globalThis.fetch swapped to simulate outages and a temporary database via DATABASE_FILE; npm test green

Blocked by

None - can start immediately