fix(web): global [hidden] bug, progress bar, F5 persistence, finding detail + PoC

Real front-end bugs found and fixed:
- [hidden] never worked on any element whose class also sets 'display'
  (every .btn, .chip, ...): the browser's built-in '[hidden]{display:none}'
  rule and an author rule of equal specificity tie, and the later one in the
  cascade wins — so 'Next' stayed visible on the Review step alongside
  'Start Exploitation', and 'Open report'/'Stop' rendered during 'starting'.
  Fixed with a single global '[hidden]{display:none!important}' override.
- Progress bar was functionally correct but easy to miss (thin, 0%-width,
  low-contrast track) and gave no feedback while the agent count is still
  unknown (recon phase). Added a border for visibility and an indeterminate
  sliding-segment state for the 'agents: ?' window.
- A live run watched in the browser was lost on F5 (jumped back to the
  wizard) even though the job keeps running server-side. The active job id
  now persists in localStorage; on load the app reconnects the SSE stream
  (the server replays its full event buffer) instead of losing the view.

New:
- Findings are now clickable — a detail modal shows every Finding field
  (CWE/CVSS/OWASP/MITRE/stage/exploitability/confidence/votes/review status/
  auth context/account/agent), endpoint+payload, evidence, impact, business
  impact, remediation, and chains_from — in both the live run and past-run
  detail views.
- PoC surfacing: the finding modal looks up any script the run wrote to
  pocs/ that's cited in the finding's evidence (per the harness's own
  doctrine — see pipeline.rs change below), fetches and previews it inline,
  with a link to open the raw file. Live runs poll for new PoC files every
  5s once the run id is known.
- Pinned-leads confirmation: the live run header now states plainly how
  many leads were pinned (and their names) or that selection is auto
  (recon-driven) — this was previously buried in the scrolling activity log
  behind the harness's unconditional 'Loaded 435 agents' library-size line,
  which describes the full agent library, not what will actually run.

Harness doctrine (crates/harness/src/pipeline.rs, pocs_line()):
PoC-writing for black-box findings was previously conditioned on 'when an
issue needs a custom multi-step exploit/script' — vague enough that a
straightforward finding (single-request XSS/SQLi/IDOR) often got no PoC
file at all. Now required for every confirmed Medium+ finding, one
standalone .py/.sh script per finding, and explicit about citing the exact
file name in the finding's evidence field (which is what the web UI now
matches on to link a PoC to its finding).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0129WdYHccPsH27k5GGuwijd

neurosploit-rs/crates/harness/src/pipeline.rs

@@ -175,9 +175,13 @@ fn proxy_line() -> String {
 fn pocs_line() -> String {
     match std::env::var("NEUROSPLOIT_POCS").ok().filter(|v| !v.trim().is_empty()) {
         Some(d) => format!(
-            "POCS: when an issue needs a custom multi-step exploit/script to prove it, WRITE a runnable PoC \
-             (curl/python/bash) to {d}/ with a short header comment (target, what it proves, usage), run it to \
-             confirm, and reference the file path in the finding evidence.\n         "),
+            "POCS (required for every confirmed Medium+ finding): before reporting it, WRITE a standalone, \
+             runnable PoC to {d}/<short-slug>.py or {d}/<short-slug>.sh (prefer Python or Bash — one file per \
+             finding, not per step) that reproduces the vulnerability end-to-end: target, exact payload/request, \
+             and the observable proof (response snippet, status code, timing, etc.). Header comment: what it \
+             proves, how to run it. Actually RUN it once to confirm it works before citing it. Put the exact file \
+             name (e.g. `pocs/idor_order_id.py`) in the finding's `evidence` field so the report and UI can link \
+             it — a finding without a cited PoC path looks unproven.\n         "),
         None => String::new(),
     }
 }