feat: browser session persistence, auto-screenshots, context optimization, user cleanup

Browser tool:
- Session-persistent Chrome tab (same tab reused across all calls in a pentest)
- Auto-screenshot on every navigate and click (stored in attack chain for report)
- Fill uses CDP Input.insertText (fixes WebSocket corruption on special chars)
- Switched from browserless/chromium to chromedp/headless-shell (stable WS)

Context window optimization:
- Strip screenshot_base64 from LLM conversation (kept in DB for report)
- Truncate HTML to 2KB, page text to 1.5KB in LLM messages
- Cap element/link arrays at 15 items
- SAST triage: batch 30 findings per LLM call instead of all at once

Report improvements:
- Auto-embed screenshots in attack chain timeline (navigate + click nodes)
- Cover page shows best app screenshot
- Attack chain phases capped at 8 (no more 20x "Final")

User cleanup:
- TestUserRecord model tracks created test users per session
- cleanup.rs: Keycloak (Admin REST API), Auth0 (Management API), Okta (Users API)
- Auto-cleanup on session completion when cleanup_test_user is enabled
- Env vars: KEYCLOAK_ADMIN_USERNAME, KEYCLOAK_ADMIN_PASSWORD

System prompt:
- Explicit browser usage instructions (navigate → get_content → click → fill)
- SPA auth bypass guidance (check page content, not HTTP status)
- Screenshot instructions for evidence collection

Other:
- Pin mongo:7 in docker-compose (mongo:latest/8 segfaults on kernel 6.19)
- Add deploy/docker-compose.mailserver.yml for Postfix + Dovecot

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

compliance-dashboard/src/components/attack_chain/helpers.rs

@@ -118,9 +118,12 @@ pub(crate) fn cat_label(cat: &str) -> &'static str {
     }
 }
 
-/// Phase name heuristic based on depth
-pub(crate) fn phase_name(depth: usize) -> &'static str {
-    match depth {
+/// Maximum number of display phases — deeper iterations are merged into the last.
+const MAX_PHASES: usize = 8;
+
+/// Phase name heuristic based on phase index (not raw BFS depth)
+pub(crate) fn phase_name(phase_idx: usize) -> &'static str {
+    match phase_idx {
         0 => "Reconnaissance",
         1 => "Analysis",
         2 => "Boundary Testing",
@@ -133,8 +136,8 @@ pub(crate) fn phase_name(depth: usize) -> &'static str {
 }
 
 /// Short label for phase rail
-pub(crate) fn phase_short_name(depth: usize) -> &'static str {
-    match depth {
+pub(crate) fn phase_short_name(phase_idx: usize) -> &'static str {
+    match phase_idx {
         0 => "Recon",
         1 => "Analysis",
         2 => "Boundary",
@@ -214,7 +217,14 @@ pub(crate) fn compute_phases(steps: &[serde_json::Value]) -> Vec<Vec<usize>> {
         }
     }
 
-    // Group by depth
+    // Cap depths at MAX_PHASES - 1 so deeper iterations merge into the last phase
+    for d in depths.iter_mut() {
+        if *d >= MAX_PHASES {
+            *d = MAX_PHASES - 1;
+        }
+    }
+
+    // Group by (capped) depth
     let max_depth = depths.iter().copied().max().unwrap_or(0);
     let mut phases: Vec<Vec<usize>> = Vec::new();
     for d in 0..=max_depth {