fix(evaluations): bypass Cloudflare 403 with browser headers + hardcoded fallback rounds

- Add browser User-Agent and Referer headers to all evals.mitre.org requests
- fetch_rounds_with_status() returns api_reachable flag + rounds list
- Fallback to 5 known public CrowdStrike rounds (APT29/R2 through OilRig/R6)
  when live API is blocked, so UI always shows something actionable
- Router returns {rounds, api_reachable, api_error} instead of plain array
- Frontend shows orange warning banner when using fallback data
- Remove 502 HTTPException - rounds are always returned (live or fallback)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/api/system.ts

@@ -53,6 +53,12 @@ export interface EvaluationRound {
   techniques_covered: number | null;
 }
 
+export interface EvaluationRoundsResponse {
+  rounds: EvaluationRound[];
+  api_reachable: boolean;
+  api_error: string | null;
+}
+
 export interface EvaluationImportResult {
   message: string;
   created: number;
@@ -70,8 +76,8 @@ export interface NewRoundCheckResult {
 }
 
 /** List all public CrowdStrike evaluation rounds with import status. */
-export async function listEvaluationRounds(): Promise<EvaluationRound[]> {
-  const { data } = await client.get<EvaluationRound[]>("/system/attck-evaluations/rounds");
+export async function listEvaluationRounds(): Promise<EvaluationRoundsResponse> {
+  const { data } = await client.get<EvaluationRoundsResponse>("/system/attck-evaluations/rounds");
   return data;
 }