…tch 8)

Apply the #206 playbook to security.ts. 25 `as never` casts removed.

src/lib/api/security.ts:
  + 9 read adapters: adaptDashboard / adaptScore / adaptScan / adaptScanList /
    adaptFinding / adaptFindingList / adaptPolicy / adaptScanConfig /
    adaptRepoSecurity / adaptTriggerScanResponse — each normalizes SDK's
    `?: T | null` to local type's `: T | null`.
  + 4 write adapters: adaptTriggerRequest / adaptCreatePolicyRequest /
    adaptUpdatePolicyRequest / adaptUpsertConfigRequest — explicit field
    forwarding so a future local-type addition surfaces at typecheck.
  + adaptScore synthesizes total_findings from severity counts (the SDK
    ScoreResponse omits it).
  + assertData on every successful read.

Drift handling:
  - SDK PolicyResponse has fields the local ScanPolicy doesn't model
    (max_artifact_age_days, min_staging_hours, require_signature). Those
    belong to lifecycle policies, not security policies — the SDK conflates
    the two via shared CreatePolicyRequest/UpdatePolicyRequest types
    (same root cause as the SDK type leak in batch 1's lifecycle.ts).
    The adapter intentionally drops them.

Tests rewritten with realistic SDK fixtures (typed as Sdk* for compile-
time drift detection). New regression tests:
  - Score: last_scan_at undefined → null
  - listScans: nullable fields normalization
  - acknowledgeFinding: body shape forwarding
  - getRepoSecurity: null config / null score handling
  - createPolicy / updatePolicy: body shape forwarding

CHANGELOG entry under [Unreleased] / Changed.

Closes #359 (partial — batch 8 of N). Remaining: sso (large, final).