feat(4.0.0): web console — lead board + live findings + real CLI REPL

New web/ app (zero npm deps, Node http built-ins only):
- server.js reads agents_md/ to build a categorized lead board (435 agents
  auto-classified into Business Logic / Broken Access Control / Injection /
  LLM Application / Auth & Session / SSRF / API / Cloud & Infra / etc.),
  reads runs/ for history, and spawns the compiled neurosploit CLI binary
  for every exploitation job — structured findings/phase/progress are parsed
  from its stdout (finding_json:/phase lines), same signal the TUI uses.
- REPL drawer spawns `neurosploit` with no subcommand (real interactive
  session, Reader::Plain over the piped stdin) and streams stdin/stdout —
  every /command works exactly as in a terminal, nothing reimplemented.
- SSE endpoints for both job and REPL streams; run/finding/report assets
  served under /api/runs/:id/asset/*.
- public/{index,app.js,style.css}: lead board with category toggles + custom
  leads + Start Exploitation, live run view (progress/findings/log), run
  detail view, REPL drawer — screenshot-inspired layout.
- web/API.md: full endpoint reference. web/README.md: quick start.

Bump version 3.6.9 -> 4.0.0 (Cargo.toml, CLI banners, README/TUTORIAL).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0129WdYHccPsH27k5GGuwijd

README.md

@@ -1,4 +1,4 @@
-<h1 align="center">🧠 NeuroSploit v3.6.9</h1>
+<h1 align="center">🧠 NeuroSploit v4.0.0</h1>
 
 <p align="center">
   <a href="https://trendshift.io/repositories/22624?utm_source=trendshift-badge&amp;utm_medium=badge&amp;utm_campaign=badge-trendshift-22624" target="_blank" rel="noopener noreferrer"><img src="https://trendshift.io/api/badge/trendshift/repositories/22624/daily?language=Python" alt="JoasASantos%2FNeuroSploit | Trendshift" width="250" height="55"/></a>
@@ -12,7 +12,7 @@
 </p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/Version-3.6.9-blue?style=flat-square">
+  <img src="https://img.shields.io/badge/Version-4.0.0-blue?style=flat-square">
   <img src="https://img.shields.io/badge/Harness-Rust%20%7C%20tokio-e6b673?style=flat-square">
   <img src="https://img.shields.io/badge/License-MIT-green?style=flat-square">
   <img src="https://img.shields.io/badge/MD%20Agents-435-red?style=flat-square">
@@ -214,6 +214,21 @@ No login? Use an **API key** instead — see [Authentication](#authentication--r
 
 ---
 
+## 🖥️ Web console (NEW in v4.0.0)
+
+A browser UI for the same harness: a categorized lead board (toggle agents by category, add
+custom leads, `Start Exploitation`), a live structured findings view, run history, and a real
+REPL — all driven by spawning the compiled CLI, never a reimplementation of it.
+
+```bash
+cd neurosploit-rs && cargo build --release   # once
+node web/server.js                            # → http://localhost:4173
+```
+
+Zero npm dependencies. Full API reference: **[web/API.md](web/API.md)**.
+
+---
+
 ## 🔌 Integrations (GitHub · GitLab · Jira)
 
 Wire NeuroSploit into your SDLC. Toggle from the REPL (`/integrations`) or the CLI