Sprint B.9+B.10: Dependabot alerts + CI status in table, cache and CLI

- Provider::org_dependabot_counts: one org-level request per distinct owner
  (cursor pagination via Link header — page= returns 400 on this endpoint);
  403/404 → None (unknown) vs Some(0) = checked, none open
- Provider::latest_ci_status: latest Actions run on the repo's branch →
  success/failure/running; CiStatus enum with stable string form
- cache RepoMeta: ci_status + dependabot_open replace unused ci_ok;
  RepoSummary carries both, applied at startup/scan/refresh (TUI + CLI)
- Repos table: CI column (✓/✗/●) + ALERT column (count, red when >0,
  '—' = unknown); CLI: list --alerts filter, scan_repos now cache-enriched
- verified against live API: 49 repos, 44 with alert counts, CI statuses
  match reality; table rendering checked via pyte

src/cli.rs

@@ -47,6 +47,8 @@ pub enum Commands {
         #[arg(long)] lang: Option<String>,
         /// Filter by vulp project name
         #[arg(long)] project: Option<String>,
+        /// Only repos with open Dependabot alerts (cached — run refresh first)
+        #[arg(long)] alerts: bool,
     },
     /// Detailed status of one repo
     Status { repo: String },