v3.3.0 GUI dashboard + reports + model expansion + root fix

Engine:
- Fix: inject IS_SANDBOX=1 so Claude Code's --dangerously-skip-permissions
  works under root (real backend runs were exiting rc=1 immediately)
- models: expand to 40 models / 13 providers, tagged CLI vs API
  (NVIDIA NIM, DeepSeek, Mistral, Qwen/DashScope, Groq, Together, OpenRouter,
  Ollama, Gemini) — Qwen/DeepSeek/Llama usable via API
- backends: on_start callback surfaces the exact argv ("what runs behind it")
- orchestrator: require a Playwright screenshot per confirmed finding; collect
  results/activity.json; auto-generate reports after a run
- report.py: HTML always + PDF via Typst engine (.typ source emitted too)

Web dashboard (webgui/, stdlib only — no npm/build):
- Sidebar dashboard (PentAGI-style): Run / Agents / Insights / Reports / Settings
- Multi-target runs; live execution console + per-task activity; finding cards
  with screenshots; backend+provider+model pickers (CLI & API)
- Agents tab: browse 213 + add new .md agents from the UI
- Insights: interactive RL-weight + severity charts
- Reports: download/preview PDF + HTML
- Settings/API: execution mode, per-provider API keys, orchestrator, verbosity
- Endpoints: /api/agents (GET/POST), /api/rl, /api/config, /api/reports,
  /reports/* + /shots/* static serving

Cleanup: retire replaced web stack (frontend React, FastAPI backend, core
orchestration, old test) to legacy/. Active engine + GUI are fully standalone.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

legacy/backend_fastapi/schemas/vulnerability.py

@@ -0,0 +1,72 @@
+"""
+NeuroSploit v3 - Vulnerability Schemas
+"""
+from datetime import datetime
+from typing import Optional, List
+from pydantic import BaseModel
+
+
+class VulnerabilityTestResponse(BaseModel):
+    """Schema for vulnerability test response"""
+    id: str
+    scan_id: str
+    endpoint_id: Optional[str]
+    vulnerability_type: str
+    payload: Optional[str]
+    request_data: dict
+    response_data: dict
+    is_vulnerable: bool
+    confidence: Optional[float]
+    evidence: Optional[str]
+    tested_at: datetime
+
+    class Config:
+        from_attributes = True
+
+
+class VulnerabilityResponse(BaseModel):
+    """Schema for vulnerability response"""
+    id: str
+    scan_id: str
+    test_id: Optional[str]
+    title: str
+    vulnerability_type: str
+    severity: str
+    cvss_score: Optional[float]
+    cvss_vector: Optional[str]
+    cwe_id: Optional[str]
+    description: Optional[str]
+    affected_endpoint: Optional[str]
+    poc_request: Optional[str]
+    poc_response: Optional[str]
+    poc_payload: Optional[str]
+    impact: Optional[str]
+    remediation: Optional[str]
+    references: List
+    ai_analysis: Optional[str]
+    created_at: datetime
+
+    class Config:
+        from_attributes = True
+
+
+class VulnerabilityTypeInfo(BaseModel):
+    """Information about a vulnerability type"""
+    type: str
+    name: str
+    category: str
+    description: str
+    severity_range: str  # "medium-critical"
+    owasp_category: Optional[str] = None
+    cwe_ids: List[str] = []
+
+
+class VulnerabilitySummary(BaseModel):
+    """Summary of vulnerabilities for dashboard"""
+    total: int = 0
+    critical: int = 0
+    high: int = 0
+    medium: int = 0
+    low: int = 0
+    info: int = 0
+    by_type: dict = {}