[FEATURE] AI 3 : Natural Language Q&A Over Scan Findings

[TFT444]

Objective

Allow users to ask plain English questions about their scan results and receive AI powered answers.

Examples

What is the fastest path to CIS compliance?
Which of these findings is most exploitable right now?
Which findings should I fix first?

What needs to be built

• Add optional question field to POST /api/ai/insights
• Return answer field in response when question is present
• Works with all three providers
• Same endpoint, same auth, extended behaviour

Acceptance criteria

• Returns a relevant answer when question is provided
• Works with all three providers
• No answer field returned when question is not provided
• Unit testable with mocked responses

Dependencies

Depends on Issue 2 (executive summary endpoint)

Priority

High