fix(web): global [hidden] bug, progress bar, F5 persistence, finding detail + PoC

Real front-end bugs found and fixed:
- [hidden] never worked on any element whose class also sets 'display'
  (every .btn, .chip, ...): the browser's built-in '[hidden]{display:none}'
  rule and an author rule of equal specificity tie, and the later one in the
  cascade wins — so 'Next' stayed visible on the Review step alongside
  'Start Exploitation', and 'Open report'/'Stop' rendered during 'starting'.
  Fixed with a single global '[hidden]{display:none!important}' override.
- Progress bar was functionally correct but easy to miss (thin, 0%-width,
  low-contrast track) and gave no feedback while the agent count is still
  unknown (recon phase). Added a border for visibility and an indeterminate
  sliding-segment state for the 'agents: ?' window.
- A live run watched in the browser was lost on F5 (jumped back to the
  wizard) even though the job keeps running server-side. The active job id
  now persists in localStorage; on load the app reconnects the SSE stream
  (the server replays its full event buffer) instead of losing the view.

New:
- Findings are now clickable — a detail modal shows every Finding field
  (CWE/CVSS/OWASP/MITRE/stage/exploitability/confidence/votes/review status/
  auth context/account/agent), endpoint+payload, evidence, impact, business
  impact, remediation, and chains_from — in both the live run and past-run
  detail views.
- PoC surfacing: the finding modal looks up any script the run wrote to
  pocs/ that's cited in the finding's evidence (per the harness's own
  doctrine — see pipeline.rs change below), fetches and previews it inline,
  with a link to open the raw file. Live runs poll for new PoC files every
  5s once the run id is known.
- Pinned-leads confirmation: the live run header now states plainly how
  many leads were pinned (and their names) or that selection is auto
  (recon-driven) — this was previously buried in the scrolling activity log
  behind the harness's unconditional 'Loaded 435 agents' library-size line,
  which describes the full agent library, not what will actually run.

Harness doctrine (crates/harness/src/pipeline.rs, pocs_line()):
PoC-writing for black-box findings was previously conditioned on 'when an
issue needs a custom multi-step exploit/script' — vague enough that a
straightforward finding (single-request XSS/SQLi/IDOR) often got no PoC
file at all. Now required for every confirmed Medium+ finding, one
standalone .py/.sh script per finding, and explicit about citing the exact
file name in the finding's evidence field (which is what the web UI now
matches on to link a PoC to its finding).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0129WdYHccPsH27k5GGuwijd

web/server.js

@@ -318,7 +318,8 @@ async function runDetail(id) {
   ]);
   const assets = ['report.html', 'report.pdf', 'report.md', 'recon.md', 'exploitation.md']
     .filter((f) => fs.existsSync(path.join(dir, f)));
-  return { id, name: engagementNames.get(id) || '', meta, status, findings, assets };
+  const pocs = await fsp.readdir(path.join(dir, 'pocs')).catch(() => []);
+  return { id, name: engagementNames.get(id) || '', meta, status, findings, assets, pocs };
 }
 
 function safeRunDir(id) {
@@ -344,6 +345,7 @@ class Job extends EventEmitter {
     this.args = args;
     this.target = target || '';
     this.name = name || '';
+    this.pinnedAgents = [];
     this.runId = null; // ns-<ts>-<target> workdir basename, once known
     this.phase = 'starting';
     this.findings = [];
@@ -366,6 +368,7 @@ class Job extends EventEmitter {
       id: this.id,
       target: this.target,
       name: this.name,
+      pinnedAgents: this.pinnedAgents,
       runId: this.runId,
       phase: this.phase,
       findings: this.findings,
@@ -451,6 +454,7 @@ async function startJob(body) {
   const credsPath = await materializeCreds(body, id);
   const args = buildArgs({ ...body, creds: credsPath });
   const job = new Job(id, BIN, args, body.repo || body.target || '', body.name || '');
+  job.pinnedAgents = body.agents || [];
   jobs.set(id, job);
 
   const child = spawn(BIN, args, { cwd: ROOT, env: { ...process.env, ...envOverrides() } });