feat: account registration, form analysis, credential vault + cleanup (v3.6.5)

- New agent account_registration_and_forms (+1 → 430): analyzes the app's forms
  and self-registers a benign test account (curl or Playwright) to reach the
  authenticated surface when no creds are given.
- Probe extracts form details (action/method/fields/kind/CSRF) so form analysis is
  grounded; shown in the probe summary and recon JSON.
- Hard anti-flood guardrail in SAFETY_DOCTRINE + the agent: at most 2 accounts per
  engagement, never loop/script/batch the register endpoint or flood the DB; reuse
  the account made; a test needing many sign-ups is a lead, not mass-creation.
- Credential vault: engagement_ops directive tells agents to append created
  accounts to <run-dir>/vault.jsonl; finish() consolidates to vault.json, masks
  secrets in the report, and adds a 'Test accounts created (DELETE after)' cleanup
  finding listing each account and how it was created.
- Finding tagging: new auth_context (authenticated/unauthenticated) and account
  fields, rendered per-finding in the HTML report.
- Opt-in disposable email (off by default): /tempmail on + RunConfig.temp_email;
  agents may use the free mail.tm API to read a registration confirmation code.
- Tests: parse_forms unit tests; docs updated (README/TUTORIAL/RELEASE), counts 430.

RELEASE.md

@@ -37,6 +37,28 @@
   as a finder or in the validator voting panel, e.g.
   `--model anthropic:claude-opus-5 --model moonshot:kimi-k3`.
 
+- **Account registration & form analysis (+1 agent → total 430).** A new
+  `account_registration_and_forms` agent lets NeuroSploit reach the authenticated
+  surface on its own: it analyzes the app's forms (the deterministic probe now
+  extracts each `<form>`'s action/method/fields/kind/CSRF) and creates a benign
+  test account with **curl** or the **Playwright browser** when no creds are given.
+  - **Anti-flood guardrail (hard):** at most **2 accounts per engagement**, never
+    looping/scripting/batching the register endpoint or flooding the database —
+    reuse the account made; a test needing many sign-ups is reported as a lead and
+    stopped. Enforced in `SAFETY_DOCTRINE` (all flows) and the agent.
+  - **Credential vault:** every generated credential is saved to
+    **`<run-dir>/vault.json`** for the operator to consult; secrets are **masked in
+    the report**. The report adds a **"Test accounts created (DELETE after)"**
+    cleanup section listing each account and how it was created.
+  - **Finding labels:** findings are tagged **`auth_context`**
+    (authenticated/unauthenticated) and **`account`** (which test user/role proved
+    it) — so grey-box shows which findings needed a login, and black-box records how
+    the user was created.
+  - **Disposable email (opt-in, off by default):** `/tempmail on` (or `temp_email`)
+    lets agents use the free **mail.tm** API (no key) to read a registration
+    confirmation code; off by default, a required confirmation is reported as a
+    blocker rather than bypassed.
+
 ## Previously in v3.6.4