app/webui: replace generic "see summary.txt" SAT failure text with the real reason

Every place that surfaced a FAILED SAT result — task error messages,
component-status.json detail, and the hardware snapshot's ErrorDescription/
StatusHistory — used to say only "SAT overall_status=FAILED (see
summary.txt)" or "<label> failed", forcing an engineer to go dig through the
run directory to find out what actually broke.

nvidia-config's summary.txt now carries a "warnings" field with the specific
GPU/NVLink finding. A new SATFailureDetail/satFailureDetailFromKV in
component_status_db.go reads that field, or falls back to naming whichever
generic SAT sub-job(s) reported non-OK/UNSUPPORTED status along with their
exit code. This feeds both the task-runner error message and the component
status DB. sat_overlay.go's satKeyStatus (which drives ErrorDescription on
the exported hardware snapshot) now does the same, with storage kept
per-device so one drive's rc doesn't get attributed to another's card.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

audit/internal/webui/task_runner.go

@@ -437,7 +437,11 @@ func executeTaskWithOptions(opts *HandlerOptions, t *Task, j *jobState, ctx cont
 	if archive != "" {
 		archivePath := app.ExtractArchivePath(archive)
 		if err == nil && app.ReadSATOverallStatus(archivePath) == "FAILED" {
-			err = fmt.Errorf("SAT overall_status=FAILED (see summary.txt)")
+			if reason := app.SATFailureDetail(archivePath); reason != "" {
+				err = fmt.Errorf("SAT FAILED: %s", reason)
+			} else {
+				err = fmt.Errorf("SAT overall_status=FAILED (see summary.txt)")
+			}
 		}
 		// See tasks.go's identical guard: a user-aborted run must not
 		// overwrite the component status DB with a partial result.