Compliance scans: don't dispatch an auditor to a node

Defect (found by the epic 5303 finish check against the dev environment). Observed: `jaah-audit` (the node CLI the Compliance Auditor runner must call) first ships in jaah 1.1.7788 (PR #4645). On dev, read via tools/cp_psql.sh dev at 2026-10-09 ~01:00Z, `nodes.config_snapshot->>'version'` is 1.1.7280 on dev1, orgb1, ts2-node1 and trial-f45ab273, and 1.1.6755 on mac-t4743. Only pool-b, pool-b-host, build-1 and build-1-host are on 1.1.7930. All have `autoupdate_desired=true`. `scans.classify` (apps/api/app/governance/scans.py:64-70) only checks that a repo and a hosting node exist (`slot_allocation.hosting_node_ids`), so a scan of a project hosted only on such a node dispatches an auditor runner that has no `jaah-audit`. The run then fails and the row shows a generic error, with no hint that the node needs updating. Every Org B project on dev is in this state. Fix: in `classify`, count only hosting nodes whose reported version is at least the jaah-audit floor. Put the floor in ONE constant in apps/api/app/governance/ (1.1.7788, the first tag containing PR #4645) and compare with the existing version-parse helper if one exists. When hosting nodes exist but none meets the floor, mark the target not-scannable with a reason the user can act on: "the node hosting this project is too old to scan (needs jaah ≥ 1.1.7788) — update the node". Use the existing not_scannable_no_node state plus a reason/fix hint pointing at the nodes page if the S1 closed state list forbids a new state. Add a new S1 state only if the architecture's closed list is extended in states.py/states.ts together with their parity test. Done means: - An API test: a project whose only hosting node reports version 1.1.7280 is classified not scannable with the update-node reason, and no auditor task is created. The same project on a 1.1.7930 node dispatches as today. - The matrix row for that project shows the update-node hint (component or API test asserting the reason text). - states.py / states.ts parity test still passes. `./dc check full` is green. Out of scope: fixing node autoupdate itself, upgrading dev nodes, changing slot allocation, any other scan states.

Scans now skip projects whose hosting nodes are all below jaah 1.1.7788: not_scannable_no_node + "update the node" hint on matrix/repo, no auditor task. Full gate green, PR #4699 merged, dev deploy succeeded. Deferred: placement can still pick an old node.