feat: account registration, form analysis, credential vault + cleanup (v3.6.5)

- New agent account_registration_and_forms (+1 → 430): analyzes the app's forms
  and self-registers a benign test account (curl or Playwright) to reach the
  authenticated surface when no creds are given.
- Probe extracts form details (action/method/fields/kind/CSRF) so form analysis is
  grounded; shown in the probe summary and recon JSON.
- Hard anti-flood guardrail in SAFETY_DOCTRINE + the agent: at most 2 accounts per
  engagement, never loop/script/batch the register endpoint or flood the DB; reuse
  the account made; a test needing many sign-ups is a lead, not mass-creation.
- Credential vault: engagement_ops directive tells agents to append created
  accounts to <run-dir>/vault.jsonl; finish() consolidates to vault.json, masks
  secrets in the report, and adds a 'Test accounts created (DELETE after)' cleanup
  finding listing each account and how it was created.
- Finding tagging: new auth_context (authenticated/unauthenticated) and account
  fields, rendered per-finding in the HTML report.
- Opt-in disposable email (off by default): /tempmail on + RunConfig.temp_email;
  agents may use the free mail.tm API to read a registration confirmation code.
- Tests: parse_forms unit tests; docs updated (README/TUTORIAL/RELEASE), counts 430.

README.md

@@ -15,7 +15,7 @@
   <img src="https://img.shields.io/badge/Version-3.6.5-blue?style=flat-square">
   <img src="https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673?style=flat-square">
   <img src="https://img.shields.io/badge/License-MIT-green?style=flat-square">
-  <img src="https://img.shields.io/badge/MD%20Agents-429-red?style=flat-square">
+  <img src="https://img.shields.io/badge/MD%20Agents-430-red?style=flat-square">
   <img src="https://img.shields.io/badge/Models-15%20providers-success?style=flat-square">
   <img src="https://img.shields.io/badge/Modes-Black%20%7C%20White%20%7C%20Grey%20%7C%20Host%20%7C%20AI-9cf?style=flat-square">
   <img src="https://img.shields.io/badge/Auth-API%20key%20%7C%20Subscription-orange?style=flat-square">
@@ -38,7 +38,13 @@
 > runs an attacker→**LLM-judge** loop — capture the baseline refusal, apply the
 > technique across variants, judge whether the guardrail was truly bypassed —
 > proving it with a **benign, redacted** receipt. `neurosploit aitest <ai-url>`.
-> Also adds **Claude Opus 5**, **Claude Sonnet 5**, and **Kimi K3** (new Moonshot
+> Also: **self-service test-account registration** — analyzes the app's forms and
+> creates a benign account (curl or Playwright) to reach the **authenticated**
+> surface, with a hard **anti-flood guardrail** (≤2 accounts), a per-run
+> **credential vault** (`vault.json`, secrets masked in the report), a **"delete
+> these accounts" cleanup** section, findings tagged **authenticated /
+> unauthenticated**, and **opt-in disposable email** (`/tempmail`, free mail.tm).
+> New models: **Claude Opus 5**, **Claude Sonnet 5**, **Kimi K3** (new Moonshot
 > provider → 15 providers). Full history in [RELEASE.md](RELEASE.md).
 
 ---
@@ -49,7 +55,7 @@ LLMs** — via **API key** or local **subscription** (Claude Code / Codex / Gemi
 Grok) — recons the target, **intelligently selects only the agents that match the
 discovered surface**, runs them in parallel, **chains** findings into deeper
 impact, and **validates every claim by cross-model voting + tool-receipt
-grounding** before reporting. It ships **429 markdown agents** and a **Mission
+grounding** before reporting. It ships **430 markdown agents** and a **Mission
 Control TUI**.
 
 ### Engagement modes