feat(4.0.0): web console — lead board + live findings + real CLI REPL

New web/ app (zero npm deps, Node http built-ins only):
- server.js reads agents_md/ to build a categorized lead board (435 agents
  auto-classified into Business Logic / Broken Access Control / Injection /
  LLM Application / Auth & Session / SSRF / API / Cloud & Infra / etc.),
  reads runs/ for history, and spawns the compiled neurosploit CLI binary
  for every exploitation job — structured findings/phase/progress are parsed
  from its stdout (finding_json:/phase lines), same signal the TUI uses.
- REPL drawer spawns `neurosploit` with no subcommand (real interactive
  session, Reader::Plain over the piped stdin) and streams stdin/stdout —
  every /command works exactly as in a terminal, nothing reimplemented.
- SSE endpoints for both job and REPL streams; run/finding/report assets
  served under /api/runs/:id/asset/*.
- public/{index,app.js,style.css}: lead board with category toggles + custom
  leads + Start Exploitation, live run view (progress/findings/log), run
  detail view, REPL drawer — screenshot-inspired layout.
- web/API.md: full endpoint reference. web/README.md: quick start.

Bump version 3.6.9 -> 4.0.0 (Cargo.toml, CLI banners, README/TUTORIAL).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0129WdYHccPsH27k5GGuwijd

neurosploit-rs/Cargo.toml

@@ -3,7 +3,7 @@ members = ["crates/harness", "app"]
 resolver = "2"
 
 [workspace.package]
-version = "3.6.9"
+version = "4.0.0"
 edition = "2021"
 license = "MIT"
 repository = "https://github.com/JoasASantos/NeuroSploit"