v4.3.0: web console parity + report redaction + per-finding wire evidence & re-test

Harness / CLI
- redact: credentials become $SECRET_n in every human-facing report
  (md/html/json/sarif/typ, findings.md); findings.json & vault keep raw values.
- poc: `--only <id> --json` re-tests a single finding (powers the web Re-test).
- version bump 4.2.4 → 4.3.0 (Cargo, CLI banner, web).

Web console
- Attack graph replaces "Generative Attack Path Chaining": one tab, findings
  ordered by kill-chain stage, click a finding to open it. Mounted in detail + live.
- Finding modal: Wire evidence — the real request/response pairs behind a finding
  (baseline/attack, identity pair, matrix probes, oracle) with wire provenance,
  the wire-check summary, and recorded flows on the same endpoint.
- Per-finding Re-test with dated history (reproduced/changed/gone/unverifiable).
- Transcript viewer in the Traces tab (navigable blocks; search spans all agents).
- Regression vs the previous run of the same target: new / recurring badges and a
  "fixed since" banner.
- Chains tab: readable formatting (node refs as chips, relations as labels).
- Custom lead: describe-it (Claude writes it) OR paste your own agent/system
  prompt (verbatim); remove a custom lead from the board.
- GDPR added to compliance mapping; LLM API keys tab clarified; Reasoning-budget
  and Authorization layouts fixed; NeuroSploit logo added.

Docs / config
- README rewritten as a concise landing page; TUTORIAL.md updated to v4.3.0 with
  new web/graph/Neo4j/wire sections and first-time configuration.
- .env.example: v4.3.0, Z.ai/Moonshot keys, Neo4j + graph-salt + capability env.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -1,4 +1,4 @@
-# NeuroSploit v3.5.1 — environment / API keys (optional)
+# NeuroSploit v4.3.0 — environment / API keys (optional)
 # ------------------------------------------------------------------
 # You only need this for the API-key auth path. If you log in with a
 # local subscription CLI instead (--subscription with Claude / Codex /
@@ -42,6 +42,12 @@ MISTRAL_API_KEY=
 # qwen:        https://dashscope-intl.aliyuncs.com/  (Alibaba DashScope)
 DASHSCOPE_API_KEY=
 
+# zai:         https://z.ai/  (GLM models)
+ZAI_API_KEY=
+
+# moonshot:    https://platform.moonshot.ai/  (Kimi models)
+MOONSHOT_API_KEY=
+
 # groq:        https://console.groq.com/keys
 GROQ_API_KEY=
 
@@ -75,3 +81,25 @@ LITELLM_API_KEY=
 # EVIDENCE, refining confidence and the needs-review boundary. Additive — never
 # overrules a deterministic validator. Disable with NEUROSPLOIT_TYPESAFE=off.
 TYPESAFE_API_KEY=
+
+# ------------------------------------------------------------------
+# Attack-graph memory (Neo4j) — OPTIONAL. The graph is always written to the
+# run's graph/ folder; these only add a live Neo4j sync so paths accumulate
+# across runs. Pass the URI with --neo4j <uri> (or set NEO4J_URI); credentials
+# come ONLY from the environment, never flags, never written to disk.
+#NEO4J_URI=bolt://localhost:7687
+#NEO4J_USER=neo4j
+#NEO4J_PASSWORD=
+#NEO4J_DATABASE=neo4j
+# Salt for the graph's secret fingerprints (so credential reuse correlates
+# without storing any secret). Share one value across a team that shares a Neo4j.
+# Defaults to ~/.neurosploit/graph-salt when unset.
+#NEUROSPLOIT_GRAPH_SALT=
+
+# Target-authorization gate — OPTIONAL. When set, the harness verifies a signed
+# capability token (minted with `neurosploit capability issue`) before any recon
+# and refuses targets outside the grant.
+#NEUROSPLOIT_CAPABILITY_KEY=
+#
+# (For blind classes — SSRF/XXE/blind RCE — pass an out-of-band domain you
+#  control with the --oob-domain flag; without it those are reported as leads.)