Remove the Licenses tab the Compliance tab replaced (#37)

* fix(scan): match distro packages an SBOM never labelled with an OS

Trivy picks a distro advisory database from an operating-system component,
not from package PURLs, so a supplier SBOM listing every rpm on an image
reported zero vulnerabilities. Measured on Trivy 0.71.2: 0 findings without
the component, 306 with it; SPDX behaves the same (0 -> 166) and needs the
SPDXRef-OperatingSystem id prefix, not primaryPackagePurpose.

Infer the distro from the packages and scan an enriched copy — the upload
itself is never edited, since it backs the conformance verdict and the
signature bundle. A second defect surfaced alongside: os-pkgs results are
labelled with the distro, which no PURL reconstruction maps, so every distro
finding was dropped as "no purl". Fall back to the PURL Trivy attaches to the
finding, leaving reconstruction first so existing ecosystems are untouched.

Upstream's rewrite of an existing OS version down to its major release is
deliberately not ported: centos 7.9.2009, rocky 8.10, alma 9.3 and redhat 8.9
each matched identically with and without the minor.

* chore(web): remove the Licenses tab the Compliance tab replaced

LicensesTab / LicensesToolbar stopped being routed when ComplianceTab took
over (W9-#58), but the files and their unit test stayed, so the screen still
read as live. Remove them along with useLicenses, whose only caller they were.

licensesApi keeps listProjectLicenses: the list endpoint is staying as a REST
surface a CI job can call, and this file is where it is typed and tested. That
it now has no in-app caller is stated in the file. Comments that pointed at the
removed files were repointed at what they actually mirror.

Author: haksungjang

apps/frontend/src/features/projects/api/licensesApi.ts

@@ -3,14 +3,19 @@
 /**
  * Licenses wire surface — Phase 3 PR #12.
  *
- * Two read-only endpoints back the project Licenses tab + drawer:
+ * Two read-only endpoints:
  *
  *   - GET /v1/projects/{id}/licenses        → LicenseListResponse
  *   - GET /v1/license_findings/{finding_id} → LicenseDetailResponse
  *
  * The wire types mirror `apps/backend/schemas/license_detail.py` 1:1
- * (snake_case). Hooks in `./useLicenses.ts` and `./useLicenseFinding.ts`
- * wrap these in TanStack Query.
+ * (snake_case). `./useLicenseFinding.ts` wraps the single-finding read in
+ * TanStack Query, and the drawer consumes it.
+ *
+ * `listProjectLicenses` currently has no caller in the app: the Compliance tab
+ * replaced the Licenses tab and reads its own endpoint. It is kept because the
+ * list endpoint itself is kept — it is part of the REST surface a CI job can
+ * call — and this file is where that surface is typed and tested.
  *
  * Read-only domain: license findings carry no analyst workflow (no status
  * transitions, no audit log). ORT's ruleset is the authoritative classifier

apps/frontend/src/features/projects/api/useLicenses.ts

@@ -3,8 +3,8 @@
 /**
  * useObligations — Phase 3 PR #13.
  *
- * Paginated query for the project's obligations. Mirrors `useLicenses` (PR
- * #12): `useQuery` (not `useInfiniteQuery`) because the read is read-only
+ * Paginated query for the project's obligations. `useQuery` (not
+ * `useInfiniteQuery`) because the read is read-only
  * and the distribution payload only makes sense per filter slice; flattening
  * pages would muddle the chart semantics.
  */

apps/frontend/src/features/projects/api/useObligations.ts

@@ -41,7 +41,7 @@
  *   - ``?compliance_sort=category|license_name|spdx_id|affected_count``
  *   - ``?compliance_order=asc|desc``     order toggle
  *   - ``?compliance_page=N``             1-based page index
- *   - ``?license=<finding_id>``          drawer selection (shared with LicensesTab)
+ *   - ``?license=<finding_id>``          drawer selection
  *
  * Backward compatibility (W4-C)
  * -----------------------------
@@ -280,7 +280,7 @@ export function ComplianceTab({
     parsePage(searchParams.get("compliance_page")),
   );
 
-  // Drawer selection. ``?license=<finding_id>`` is shared with LicensesTab so
+  // Drawer selection. The ``?license=<finding_id>`` key predates this tab, so
   // a deep-link from a chart or a recent-finding card still works.
   const drawerId = searchParams.get("license");
   const drawerOpen = drawerId != null && drawerId.length > 0;