fix(report): restore lockfileSource to report.json payload (#1263)

[Fire162]

What changed and why

Restores lockfileSource to report.json alongside scannedAt and cliVersion in handleSingleFolderScan (src/scan/single-scan.ts).

When #1176 unified report.json with the --json payload builder, lockfileSource was omitted because it is not part of the standard --json output. Adding lockfileSource: reportData.lockfileSource to jsonPayload restores the field so report.json remains a strict superset of the --json shape.

Also updates test assertions in tests/html-reporter.test.ts and tests/e2e/validation-and-outputs.test.ts to verify lockfileSource presence in report.json and absence from the standard --json payload.

Closes #1263