feat(reporting): store and display IP address on CARD queue items

Adds ip_address column to ivanti_todo_queue so CARD entries carry the
host IP needed to locate the asset in CARD.

- Migration: ALTER TABLE ADD COLUMN ip_address TEXT (safe to re-run)
- Backend: accepts ip_address in POST body, stores up to 64 chars
- Frontend: captures finding.ipAddress when adding to queue; CARD items
  in the queue panel show the IP in green instead of the CVE list

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/server.js

@@ -138,6 +138,7 @@ const db = new sqlite3.Database('./cve_database.db', (err) => {
             finding_id TEXT NOT NULL,
             finding_title TEXT,
             cves_json TEXT,
+            ip_address TEXT,
             vendor TEXT NOT NULL,
             workflow_type TEXT NOT NULL CHECK(workflow_type IN ('FP', 'Archer', 'CARD')),
             status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'complete')),