feat: graph memory in the test loop, wire-bound evidence, authz matrix, report redaction

Harness
- graph_memory: typed attack graph (web + internal network) with Neo4j sync
  over the HTTP API. Graph checkpoints run after recon, validation, each
  chaining round and at the end. They direct agent selection and feed the
  live chains, next moves and dependency todolist into every prompt.
- wire: every reported exchange is checked against recorded flows and
  re-sent through the scope-guarded replay engine. A contradiction means the
  finding cannot stand as confirmed.
- traces: each agent's transcript is shared with the others as a fenced,
  structured digest (endpoints, params, error signatures, versions).
- authz_matrix: role x route authorization matrix validator, with
  identity tiers in creds.
- deliverables: evidence custody, exploit-as-test (honest oracles only),
  detection content and personas, with no credential leakage.
- redact: credentials quoted by agents become $SECRET_n in every
  human-facing report (md/html/json/sarif/typ, findings.md). findings.json
  and the vault keep raw values for re-testing.
- compliance: GDPR replaces LGPD.
- New agents: authorization_matrix, session_lifecycle, api_token_structure,
  exposed_datastore, postgres_superuser_rce, meta/graph_reasoning.

Web console
- New tabs, mounted in both the detail and live views: Attack graph
  (replaces Generative Attack Path Chaining), Chains, Dependencies,
  Traffic, Traces, Deliverables.
- Wire/Status columns, KPIs, CSV export.
- Graph recompute / Neo4j push / Re-test actions, all through the CLI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015v24fuCWxkanS31HDmaDB6

web/README.md

@@ -14,9 +14,10 @@ CLI binary, never a reimplementation of harness logic.
 - **Auth & Keys** (one menu, 🔑 in the sidebar) — target auth header + named roles for
   IDOR/BOLA/BFLA testing, per-provider API keys (kept in server memory only, never on disk), and
   an explicit `creds.yaml` path override.
-- **Generative Attack Path Chaining** — findings are grouped into kill-chain columns
-  (recon → initial-access → execution → privesc → lateral → exfil → impact) with chained findings
-  linked back to their parent, built live as findings stream in.
+- **Attack graph** — the run's graph memory (web + internal network): host → service → finding →
+  credential → impact, every edge marked confirmed / needs validation / hypothesis, findings ordered
+  by kill-chain stage. Refreshed live at each graph checkpoint; click a finding to open it. Chains
+  and Dependencies list the same paths as text and as the step-by-step todolist.
 - **Terminal dock (xterm.js)** — `❭_` in the sidebar, the topbar button, or `Ctrl+\`` opens a
   docked terminal running a real `neurosploit` REPL session. Its stdout is streamed **unstripped**,
   so the harness's own colour and box-drawn panels render as they do in a local shell. Line