v3.4.0: subscription backend (Claude Code / Codex / Grok logins)

The Rust harness can now use models two ways:
- API: provider API key (OpenAI-compatible HTTP) — existing path
- Subscription: drive the locally-installed agentic CLI login directly, no API
  key (anthropic→claude, openai→codex, xai→grok)

- models.rs: ChatClient::chat_cli spawns the CLI (stdin prompt), cli_binary_for
  + installed_cli_backends + binary_in_path PATH detection
- pool.rs: ModelPool::with_auth(subscription); one() routes per model
- types/CLI: RunConfig.subscription + `run --subscription` flag
- web: /api/run honors "subscription"; /api/info reports detected cli_backends;
  SPA gets a "Use subscription" toggle

Verified live: `run --subscription --model anthropic:claude-haiku-4-5` drove the
Claude subscription end-to-end (recon + agent + vote) with no API key set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -29,7 +29,10 @@ and a **reinforcement-learning** loop that gets smarter every run.
 > ./target/release/neurosploit serve            # web dashboard → :8788
 > ./target/release/neurosploit run https://target.example --model anthropic:claude-opus-4-8 --model openai:gpt-5.1
 > ./target/release/neurosploit run https://t.example --offline   # pipeline self-test, no API keys
+> ./target/release/neurosploit run https://t.example --subscription --model anthropic:claude-opus-4-8  # uses Claude Code login, no API key
 > ```
+> Two auth paths: **model APIs** (provider key) or **subscription** — drive your
+> local **Claude Code** / **Codex** / **Grok** logins directly (no API key).
 > 11 OpenAI-compatible providers / 31 models (Claude, GPT, Grok, NVIDIA NIM,
 > DeepSeek, Mistral, Qwen, Groq, Together, OpenRouter, Ollama). Reads the same
 > `agents_md/` library (213 agents).