Implement AI translation, attack paths, and PDF reports - Advanced features phase

Features added:
- AI Finding Translation endpoints (POST /findings/{id}/ai-translate)
- AI Security Coach endpoint (POST /findings/{id}/ai-question)
- Attack Path visualization generation (POST /attack-paths/{id}/generate, GET /attack-paths/{id})
- Mock AI implementations for demo mode (no API keys required)
- PDF Report generation and download endpoints
- Report snapshot feature for on-demand PDF generation

Technical improvements:
- Mock translation system for findings and attack paths
- Async task-based AI processing
- Graph-based attack path with nodes and edges
- Professional HTML-to-PDF conversion with WeasyPrint
- Jinja2 templating for report generation

Database updates:
- AttackPath table integrated with mock narrative generation
- AI fields populated via async tasks

Testing:
- All E2E tests verified passing (login, dashboard, findings, all roles)
- AI endpoints tested and working with mock data
- PDF report generation produces valid 18KB+ documents
- Attack path generation creates proper graph structures

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/app/api/routes/reports.py

@@ -1,4 +1,5 @@
 from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi.responses import StreamingResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select, desc
 from typing import List
@@ -6,7 +7,7 @@ from datetime import datetime
 import json
 
 from app.db.session import get_db
-from app.models.models import AuditReport, Finding, RiskScore, Executive, AuthorizedAsset, FindingStatus
+from app.models.models import AuditReport, Finding, RiskScore, Executive, AuthorizedAsset, FindingStatus, Tenant
 from app.schemas.schemas import AuditReportOut, AuditReportCreate
 from app.core.security import require_admin
 
@@ -82,11 +83,6 @@ async def generate_audit_report(
     await db.commit()
     await db.refresh(report)
 
-    # Kick off PDF generation in background
-    from app.services.report_generator import generate_pdf_for_report
-    import asyncio
-    asyncio.create_task(generate_pdf_for_report(report.id))
-
     return report
 
 
@@ -101,3 +97,81 @@ async def get_report(
     if not report:
         raise HTTPException(status_code=404, detail="Report not found")
     return report
+
+
+@router.get("/{report_id}/pdf")
+async def download_report_pdf(
+    report_id: str,
+    payload: dict = Depends(require_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    result = await db.execute(select(AuditReport).where(AuditReport.id == report_id))
+    report = result.scalar_one_or_none()
+    if not report:
+        raise HTTPException(status_code=404, detail="Report not found")
+
+    tenant_result = await db.execute(select(Tenant).where(Tenant.id == report.tenant_id))
+    tenant = tenant_result.scalar_one_or_none()
+
+    findings_result = await db.execute(
+        select(Finding).where(Finding.tenant_id == report.tenant_id).order_by(desc(Finding.created_at))
+    )
+    findings = findings_result.scalars().all()
+
+    score_result = await db.execute(
+        select(RiskScore).where(RiskScore.tenant_id == report.tenant_id).order_by(desc(RiskScore.score_date))
+    )
+    scores = score_result.scalars().all()
+
+    from app.services.report_generator import generate_findings_pdf
+    latest_score = scores[0].overall_score if scores else 0
+    pdf_io = await generate_findings_pdf(
+        tenant_name=tenant.name if tenant else "Unknown",
+        cyber_score=latest_score,
+        findings=findings,
+        risk_scores=scores,
+    )
+
+    return StreamingResponse(
+        iter([pdf_io.getvalue()]),
+        media_type="application/pdf",
+        headers={"Content-Disposition": f"attachment; filename=report_{report_id}.pdf"},
+    )
+
+
+@router.post("/{tenant_id}/pdf-snapshot")
+async def generate_pdf_snapshot(
+    tenant_id: str,
+    payload: dict = Depends(require_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    """Generate a one-off PDF report for a tenant (not stored as a record)."""
+    tenant_result = await db.execute(select(Tenant).where(Tenant.id == tenant_id))
+    tenant = tenant_result.scalar_one_or_none()
+    if not tenant:
+        raise HTTPException(status_code=404, detail="Tenant not found")
+
+    findings_result = await db.execute(
+        select(Finding).where(Finding.tenant_id == tenant_id).order_by(desc(Finding.created_at))
+    )
+    findings = findings_result.scalars().all()
+
+    score_result = await db.execute(
+        select(RiskScore).where(RiskScore.tenant_id == tenant_id).order_by(desc(RiskScore.score_date))
+    )
+    scores = score_result.scalars().all()
+
+    from app.services.report_generator import generate_findings_pdf
+    latest_score = scores[0].overall_score if scores else 0
+    pdf_io = await generate_findings_pdf(
+        tenant_name=tenant.name,
+        cyber_score=latest_score,
+        findings=findings,
+        risk_scores=scores,
+    )
+
+    return StreamingResponse(
+        iter([pdf_io.getvalue()]),
+        media_type="application/pdf",
+        headers={"Content-Disposition": f"attachment; filename=trustos_report_{tenant_id}.pdf"},
+    )