fix(web): global [hidden] bug, progress bar, F5 persistence, finding detail + PoC

Real front-end bugs found and fixed:
- [hidden] never worked on any element whose class also sets 'display'
  (every .btn, .chip, ...): the browser's built-in '[hidden]{display:none}'
  rule and an author rule of equal specificity tie, and the later one in the
  cascade wins — so 'Next' stayed visible on the Review step alongside
  'Start Exploitation', and 'Open report'/'Stop' rendered during 'starting'.
  Fixed with a single global '[hidden]{display:none!important}' override.
- Progress bar was functionally correct but easy to miss (thin, 0%-width,
  low-contrast track) and gave no feedback while the agent count is still
  unknown (recon phase). Added a border for visibility and an indeterminate
  sliding-segment state for the 'agents: ?' window.
- A live run watched in the browser was lost on F5 (jumped back to the
  wizard) even though the job keeps running server-side. The active job id
  now persists in localStorage; on load the app reconnects the SSE stream
  (the server replays its full event buffer) instead of losing the view.

New:
- Findings are now clickable — a detail modal shows every Finding field
  (CWE/CVSS/OWASP/MITRE/stage/exploitability/confidence/votes/review status/
  auth context/account/agent), endpoint+payload, evidence, impact, business
  impact, remediation, and chains_from — in both the live run and past-run
  detail views.
- PoC surfacing: the finding modal looks up any script the run wrote to
  pocs/ that's cited in the finding's evidence (per the harness's own
  doctrine — see pipeline.rs change below), fetches and previews it inline,
  with a link to open the raw file. Live runs poll for new PoC files every
  5s once the run id is known.
- Pinned-leads confirmation: the live run header now states plainly how
  many leads were pinned (and their names) or that selection is auto
  (recon-driven) — this was previously buried in the scrolling activity log
  behind the harness's unconditional 'Loaded 435 agents' library-size line,
  which describes the full agent library, not what will actually run.

Harness doctrine (crates/harness/src/pipeline.rs, pocs_line()):
PoC-writing for black-box findings was previously conditioned on 'when an
issue needs a custom multi-step exploit/script' — vague enough that a
straightforward finding (single-request XSS/SQLi/IDOR) often got no PoC
file at all. Now required for every confirmed Medium+ finding, one
standalone .py/.sh script per finding, and explicit about citing the exact
file name in the finding's evidence field (which is what the web UI now
matches on to link a PoC to its finding).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0129WdYHccPsH27k5GGuwijd

web/public/index.html

@@ -204,6 +204,7 @@
           <div class="run-target" id="liveTarget">—</div>
           <div class="run-meta" id="liveTargetSub" style="font-family: var(--mono);"></div>
           <div class="run-meta"><span class="phase-dot" id="phaseDot"></span><span id="livePhase">starting</span></div>
+          <div class="run-meta" id="livePinned" style="font-family: var(--mono);"></div>
         </div>
         <div class="run-actions">
           <a class="btn" id="btnOpenReport" target="_blank" hidden>Open report</a>
@@ -212,7 +213,7 @@
         </div>
       </header>
       <div class="progress-wrap">
-        <div class="progress-bar"><div class="progress-fill" id="progressFill"></div></div>
+        <div class="progress-bar" id="progressBar"><div class="progress-fill" id="progressFill"></div></div>
         <div class="progress-label" id="progressLabel">0 / 0 agents</div>
       </div>
       <nav class="run-tabs">
@@ -294,6 +295,32 @@
   </div>
 </div>
 
+<!-- ============ FINDING DETAIL MODAL ============ -->
+<div class="modal-overlay" id="findingModal" hidden>
+  <div class="modal" style="width: 760px;">
+    <div class="modal-head">
+      <div>
+        <span class="sev" id="fmSev">—</span>
+        <span class="title" id="fmTitle" style="margin-left:8px;">—</span>
+      </div>
+      <button class="icon-btn" id="btnCloseFinding">✕</button>
+    </div>
+    <div class="modal-body">
+      <div class="review-grid" id="fmMeta" style="margin-bottom: var(--sp-5);"></div>
+
+      <div id="fmSection-evidence"></div>
+      <div id="fmSection-impact"></div>
+      <div id="fmSection-remediation"></div>
+      <div id="fmSection-chains"></div>
+
+      <div class="field-group">
+        <label class="field-label">Proof of concept</label>
+        <div id="fmPocList" class="field-help">—</div>
+      </div>
+    </div>
+  </div>
+</div>
+
 <!-- ============ REPL DRAWER ============ -->
 <div class="repl-drawer" id="replDrawer" hidden>
   <div class="repl-head">