- Filters struct: Provider, Verified (*bool), Limit, Offset - ListFindingsFiltered: optional WHERE + ORDER BY created_at DESC, id DESC - GetFinding: single-row lookup, propagates sql.ErrNoRows on miss - DeleteFinding: returns RowsAffected so caller can distinguish hit/miss - Shared scan/hydrate helpers decrypt key_value via existing Decrypt