Add GE-Enforce export-to-share + fleet-compliance UI (Milestone 1 UX)

Rounds out the Milestone 1 admin experience: author + publish in shopdb, push
to the share by a button, and see what the fleet actually did.

Export to share:
- GET/PUT /api/geenforce/config stores the on-share export root (Setting
  geenforce_share_root); POST /scopes/<id>/export-share writes the current
  published JSON to <shareroot>/<scope>/manifest.json (preinstall.json for the
  preinstall phase), backing up the existing file to _meta/history first.
  geenforce.publish gated. The engine and PCs are untouched - this is the safe
  Milestone 1 push whose rollback is restoring the history backup.
- Editor: a share-root config row + an "Export to Share" button per scope.
- 3 tests (config roundtrip, export writes the file, second export backs up).

Fleet-compliance UI (Settings > Enforcement Reports):
- New page over GET /reports + /reports/<id>: latest report per PC with
  received (applied vs latest published version), status (ok/selfhealed/failed),
  and install/skip/fail counts; row detail shows per-entry outcomes with
  self-heal flags, exit codes, and messages. Hostname/PC-type filters.
- ADR-010 settings card + ADR-009 plugin-gated route.

Full suite 883 green; frontend build + naming green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/router/routes/geenforce.js

@@ -11,5 +11,11 @@ export default [
     name: 'imagingpctypes',
     component: () => import('../../views/settings/ImagingPCTypes.vue'),
     meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
+  },
+  {
+    path: 'settings/enforcementreports',
+    name: 'enforcementreports',
+    component: () => import('../../views/settings/EnforcementReports.vue'),
+    meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
   }
 ]