Highlight precise expression ranges in diagnostics instead of full lines

[dollfins]

Description

Currently, diagnostics highlight the entire line (columns 0–1000) regardless of where the actual vulnerability is located. This makes it hard to spot which expression is problematic, especially on long lines.

Current State

In diagnostics.ts:updateDiagnostics():

const range = new vscode.Range(line, 0, line, 1000);

The full line is underlined even when the finding is about a specific expression like transfer(amount) or a + b.

Expected Behavior

• Parse the finding message or suggestion to identify the exact span of the vulnerable expression
• If the CLI provides column/end-column information, use it for precise span highlighting
• Fall back to line-level highlighting only when position data is unavailable

Implementation Notes

• The GuardFinding interface already has location.column — check if column is being used correctly
• Consider enhancing the CLI-to-extension interface to include end_column or span_length
• For O-01 (unchecked arithmetic), highlight just the arithmetic expression, not the entire function
• For A-01/A-04 (missing auth), highlight the function signature line

Acceptance Criteria

• Diagnostics highlight the relevant expression instead of the full line
• Existing findings still display correctly (backward compatible)
• Falls back to full-line highlighting when precise position is unknown
• Quick-fix code actions still work correctly with precise ranges

Complexity

Medium — requires interface coordination (extension may need CLI changes too) and careful range handling.

Points

150