fix(vuln): assign_to_user RETURNING include source_count/source_names/reopen tracking

Il RETURNING di assign_to_user mancava le colonne source_count,
source_names, reopen_count, last_resolved_at, last_reopened_at che la
struct Vulnerability si aspetta dopo l'introduzione della multi-source
attribution + reopen tracking. Risultato: sqlx errore 'no column found
for name: source_count' al runtime sul singolo POST
/api/vulnerabilities/:id/assign-user. assign_to_team e
update_vulnerability erano gia' allineati, il single-user no.

Mantengo NULL::BIGINT/TEXT[] per source_count/source_names (post-assign
non serve l'attribution: chi vuole quei dati ricarica via GET /:id).

Author: noysedog

vulnerability-manager/src/handlers/vulnerability.rs

@@ -907,7 +907,16 @@ pub async fn assign_to_user(
                   created_at, updated_at, asset_id, assigned_team_id, assigned_user_id,
                   NULL::TEXT as assigned_team_name,
                   NULL::TEXT as assigned_user_name,
-                  deleted_at
+                  deleted_at,
+                  -- multi-source attribution: la struct Vulnerability si aspetta
+                  -- queste due colonne. Qui sono NULL (post-assignment, il caller
+                  -- normalmente ricarica via GET /:id se serve l'attribution).
+                  NULL::BIGINT as source_count,
+                  NULL::TEXT[] as source_names,
+                  -- reopen tracking
+                  reopen_count,
+                  last_resolved_at,
+                  last_reopened_at
         "#
     )
     .bind(vuln_id)