Show all open (unactioned) items by default, not just the last scan

The default results view loaded only the latest scan session (±300s
window), so items dropped out of sight once a newer scan started — and
a long scheduled scan could show little or nothing on browser open.

Add get_open_items(): every flagged item with no disposition (or status
'unreviewed') across all scans, deduped by id to the latest finished
scan. GET /api/db/flagged now serves it when no ?ref is given; ?ref=N
still loads a specific past session. Frontend loadHistorySession(null)
routes to a new loadOpenItems() loader. Rename the banner button to
"Open items" (da/de/en).

get_session_items() default is unchanged — export.py and
scan_scheduler.py still rely on latest-session for the current scan's
report/email.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

routes/database.py

@@ -180,7 +180,11 @@ def db_get_disposition(item_id):
 
 @bp.route("/api/db/flagged")
 def db_flagged_items():
-    """Return flagged items from the most recent completed scan session.
+    """Return flagged items for the results grid.
+
+    With ?ref=N, returns the items from that specific past scan session (history
+    mode).  Without ref, returns every item still awaiting action across all
+    scans (the default landing view) — not just the latest session window.
     Used by the read-only viewer to load results without an active SSE connection.
     Respects viewer_scope.role stored in the session for scoped tokens.
     """
@@ -197,7 +201,13 @@ def db_flagged_items():
     else:
         user_filt = {raw_user.lower()} if raw_user else set()
     ref_scan_id = request.args.get("ref", type=int)
-    items = _get_db().get_session_items(ref_scan_id=ref_scan_id)
+    if ref_scan_id:
+        # History mode — a specific past session was requested.
+        items = _get_db().get_session_items(ref_scan_id=ref_scan_id)
+    else:
+        # Default landing / viewer — show every item still awaiting action,
+        # across all scans, not just the latest session window.
+        items = _get_db().get_open_items()
     # Normalise JSON-encoded columns the same way scan_engine does for SSE cards
     import json as _json
     out = []