perf: batch report totals for asset lists and exports

[pralav-25]

The dashboard asset list and CSV export issued one report-severity query per asset. Growing a register from 10 to 22 assets increased each request from 13 to 25 SELECTs in the regression test.

Both routes now share a register loader that fetches workspace-scoped open-report totals once and uses those totals for each asset. Query count stays constant as the register grows. Individual updates and audit events still calculate their current scores, and the existing score, archive, and CSV-escaping behavior is preserved.

Validation:

• Reproduced both query-count failures before the change.
• All 29 Python API, scoring, and schema tests pass on SQLite, including query-count regression coverage and score/export parity for open and resolved reports, flood penalties, assets without reports, and separate workspaces.
• All 4 frontend utility tests pass.
• Ruff, JavaScript syntax, and diff whitespace checks pass.
• Repository CI also runs the API suite against PostgreSQL 17.