feat: human-in-loop validator (flag not delete), MD/JSON reports, SPA methodology, robust RL

- Validator no longer silently drops uncertain findings. New Finding.review_status
  (confirmed | needs-review) + review_reason. validate() keeps partial-support as
  needs-review (drops only zero-support noise); refute_pass() demotes refuted
  High/Crit to needs-review instead of deleting; grounding::gate() flags ungrounded
  as needs-review instead of retain-dropping. Reports separate the two buckets.
- Reports: report::write_all writes report.md (human) + report.json (structured
  confirmed/needs-review/all) + report.html + Typst PDF. Wired into finalize_run
  and report_raw. HTML shows a NEEDS REVIEW badge + reason.
- SPA/REST methodology: when recon detects a JS SPA and/or REST/GraphQL API,
  inject SPA_API_DOCTRINE — directions (not an answer key) for a Juice-Shop-class
  surface: map API from JS bundle, hidden client routes, SQLi login-bypass/UNION,
  JWT none/RS→HS forge, IDOR/BOLA + mass-assignment, path-traversal + poison null
  byte, forgot-password OSINT, exposed /metrics, DOM XSS, NoSQL, SSRF, redirect
  allowlist, XXE, coupon crypto. Agents still discover and prove live.
- RL reward shaping: confirmed (severity × confidence) strong, needs-review small
  positive lead, no-find slight decay — reliable agents rise in selection.
- Tests: grounding gate flag-not-delete; report md/json bucket separation.

README.md

@@ -44,8 +44,13 @@
 > **credential vault** (`vault.json`, secrets masked in the report), a **"delete
 > these accounts" cleanup** section, findings tagged **authenticated /
 > unauthenticated**, and **opt-in disposable email** (`/tempmail`, free mail.tm).
-> New models: **Claude Opus 5**, **Claude Sonnet 5**, **Kimi K3** (new Moonshot
-> provider → 15 providers). Full history in [RELEASE.md](RELEASE.md).
+> **Human-in-the-loop validator:** uncertain findings are now **flagged
+> `needs-review`, not deleted** (only zero-support noise is dropped) so a human
+> makes the final call. **Reports in Markdown + JSON** alongside PDF/HTML. Sharper
+> agents on **modern SPA/REST apps** (a Juice-Shop-class API-hunting methodology)
+> plus **more robust RL** reward shaping. New models: **Claude Opus 5**, **Claude
+> Sonnet 5**, **Kimi K3** (Moonshot → 15 providers). Full history in
+> [RELEASE.md](RELEASE.md).
 
 ---