feat(engine): limit findings returned per scan

[Ramzi-Abidi]

Problem

Scanners such as CSV can generate very large finding arrays.

This increases memory usage, response size, logging cost, and may expose excessive uploaded content.

Proposed fix

Add maxFindings with a safe default.

Add result metadata:

findingsTruncated?: boolean;
totalFindings?: number;

Built-in scanners should stop collecting findings once their budget is exhausted.

Acceptance criteria

• Result never contains more than configured limit
• Blocking decision remains correct
• Truncation clearly reported
• CSV stops allocating findings after limit
• Custom scanner behavior documented