feat(mobile): binary/APK/IPA testing mode + 12 RE skills — v4.2.0

New `mobile` engagement mode: `neurosploit mobile <app.apk|app.ipa|binary>`
reverse-engineers a local artifact with a dedicated `mobile` agent set, all
headless and provisioned on demand (Ghidra analyzeHeadless, MobSF REST/Docker,
Frida, apktool/jadx, radare2).

Twelve original, generic skills (agents_md/mobile/, English): static binary
triage, APK static analysis, IPA static analysis, RASP & anti-tamper mapping,
root/jailbreak detection + bypass, TLS pinning detection + bypass, anti-debug
detection + bypass, obfuscation analysis & deobfuscation, code-integrity /
tamper-check bypass, hardcoded-secrets extraction, insecure local storage, and
mobile network traffic analysis. Findings are proven from the artifact
(decompilation or Frida trace), non-destructively.

- agents.rs: new `mobile` Library category (loaded, counted).
- pipeline.rs: run_mobile() mirroring the host pipeline with a mobile recon and
  headless tooling doctrine; exported from the crate.
- CLI: `Cmd::Mobile` + `Mode::Mobile`, wired in main and the TUI.
- README + TUTORIAL document the new test type; engagement-modes badge + table
  updated; "New in v4.2.0" note. Version bumped to 4.2.0 across the workspace.

383 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neurosploit-rs/agents_md/mobile/hardcoded_secrets_extraction.md

@@ -0,0 +1,18 @@
+# Hardcoded Secrets Extraction
+## User Prompt
+You are analysing **{target}** (a binary, APK or IPA on disk) for: Hardcoded Secrets Extraction. CWE-798
+
+**Context:**
+{recon_json}
+
+All tools run HEADLESS (no GUI). Provision what you need on demand (apt/pip/go); time-box each install and skip on failure. Only test artifacts you are authorized to test.
+
+### Method
+1. Extract from every layer: decompiled code, string tables, `resources.arsc`/`assets`/plist, native `.so`/Mach-O strings, embedded config/JSON, and any decrypted strings from the deobfuscation step.
+2. Classify hits: API keys, cloud credentials (AKIA..., GCP/Azure), tokens, private keys/certs, encryption keys/IVs, backend endpoints, third-party SDK secrets. Use `trufflehog`/`gitleaks`/`apkleaks` plus targeted regex.
+3. Validate liveness safely where authorized (a single benign call), and check whether a key is scoped/rotatable or grants real access.
+4. Report each secret with its exact location and a masked sample; never dump the full secret into the report.
+
+Reply ONLY with a JSON array of confirmed findings (may be []): {{id,title,severity,cwe,endpoint,payload,evidence,impact,remediation,confidence}}. `endpoint` = the file path / class / method / offset the finding lives at. Prove each with concrete evidence (a decompiled snippet, a string offset, a Frida trace, a diff), never a guess.
+## System Prompt
+You are a mobile/binary reverse-engineering specialist on an authorized assessment. You confirm findings from the artifact itself (static decompilation or dynamic instrumentation), never from assumption. Non-destructive: analyse and instrument, do not exfiltrate real user data or brick the device. When you demonstrate a bypass, prove it with a benign marker (a forced return value, a logged branch, a captured TLS line), not damage.