fix(dashboard): repair broken SBOM card on Overview

The card titled "SBOM" was displaying contribution type counts (FR/BR/EP/UPR)
which is unrelated to SBOM data. Added a sbomSnapState generator that fetches
/sbom/snapshots/ and shows: total tracked packages (sum of entry_count across
all snapshots), repos tracked, and copyleft risk count from the existing
licence_risk_count in the summary. Card turns orange if licenceRisk > 0.

Resolves suggestion b6775727.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dashboard/src/index.md

@@ -46,6 +46,24 @@ const refreshDecisions = async () => {
 refreshDecisions();
 ```
 
+```js
+// SBOM snapshots — repo coverage and total package count
+const sbomSnapState = (async function*() {
+  while (true) {
+    let snapshots = [], totalPkgs = 0;
+    try {
+      const r = await fetch(`${API}/sbom/snapshots/`);
+      if (r.ok) {
+        snapshots = await r.json();
+        totalPkgs = snapshots.reduce((s, sn) => s + (sn.entry_count ?? 0), 0);
+      }
+    } catch {}
+    yield {snapshots, totalPkgs};
+    await new Promise(res => setTimeout(res, POLL));
+  }
+})();
+```
+
 ```js
 // Registered projects — milestone events tagged with registration
 const regsState = (async function*() {
@@ -316,6 +334,8 @@ const contribCounts = summary.contribution_counts ?? {};
 const licenceRisk   = summary.licence_risk_count   ?? 0;
 const totalContribs = ["br","fr","ep","upr"].reduce((s, t) => s + (contribCounts[t] ?? 0), 0);
 const needsFollowUp = (contribCounts["submitted"] ?? 0) + (contribCounts["acknowledged"] ?? 0);
+const sbomSnaps     = sbomSnapState.snapshots ?? [];
+const totalPkgs     = sbomSnapState.totalPkgs ?? 0;
 
 display(html`<div class="grid grid-cols-3" style="gap:1rem;margin-bottom:1.5rem">
   <a class="card card-link" href="./contributions">
@@ -328,9 +348,10 @@ display(html`<div class="grid grid-cols-3" style="gap:1rem;margin-bottom:1.5rem"
     <p class="big-num">${licenceRisk}</p>
     <small>${licenceRisk === 0 ? html`<span style="color:green">✓ no copyleft in direct deps</span>` : html`<span style="color:red">copyleft in direct prod deps</span>`}</small>
   </a>
-  <a class="card card-link" href="./sbom">
+  <a class="card card-link ${licenceRisk > 0 ? 'warn' : ''}" href="./sbom">
     <h3>SBOM</h3>
-    <p class="big-num" style="font-size:1rem;padding-top:0.5rem">By type: ${["br","fr","ep","upr"].filter(t => contribCounts[t]).map(t => html`<span style="margin-right:0.4rem">${t.toUpperCase()} ${contribCounts[t]}</span>`).join("") || "—"}</p>
+    <p class="big-num">${totalPkgs.toLocaleString()}</p>
+    <small>${sbomSnaps.length} repo${sbomSnaps.length !== 1 ? "s" : ""} tracked · ${licenceRisk > 0 ? html`<span style="color:red">${licenceRisk} copyleft risks</span>` : html`<span style="color:green">✓ no copyleft</span>`}</small>
   </a>
 </div>`);
 ```