refactor: modularize codebase and add 404 unit tests

Split large files into focused modules across all crates while
maintaining API compatibility via re-exports. Add comprehensive
unit tests covering core models, pipeline parsers, LLM triage,
DAST security tools, graph algorithms, and MCP parameter validation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

compliance-dast/src/tools/auth_bypass.rs

@@ -1,5 +1,7 @@
 use compliance_core::error::CoreError;
-use compliance_core::traits::dast_agent::{DastAgent, DastContext, DiscoveredEndpoint, EndpointParameter};
+use compliance_core::traits::dast_agent::{
+    DastAgent, DastContext, DiscoveredEndpoint, EndpointParameter,
+};
 use compliance_core::traits::pentest_tool::{PentestTool, PentestToolContext, PentestToolResult};
 use serde_json::json;
 
@@ -21,16 +23,38 @@ impl AuthBypassTool {
         let mut endpoints = Vec::new();
         if let Some(arr) = input.get("endpoints").and_then(|v| v.as_array()) {
             for ep in arr {
-                let url = ep.get("url").and_then(|v| v.as_str()).unwrap_or_default().to_string();
-                let method = ep.get("method").and_then(|v| v.as_str()).unwrap_or("GET").to_string();
+                let url = ep
+                    .get("url")
+                    .and_then(|v| v.as_str())
+                    .unwrap_or_default()
+                    .to_string();
+                let method = ep
+                    .get("method")
+                    .and_then(|v| v.as_str())
+                    .unwrap_or("GET")
+                    .to_string();
                 let mut parameters = Vec::new();
                 if let Some(params) = ep.get("parameters").and_then(|v| v.as_array()) {
                     for p in params {
                         parameters.push(EndpointParameter {
-                            name: p.get("name").and_then(|v| v.as_str()).unwrap_or_default().to_string(),
-                            location: p.get("location").and_then(|v| v.as_str()).unwrap_or("query").to_string(),
-                            param_type: p.get("param_type").and_then(|v| v.as_str()).map(String::from),
-                            example_value: p.get("example_value").and_then(|v| v.as_str()).map(String::from),
+                            name: p
+                                .get("name")
+                                .and_then(|v| v.as_str())
+                                .unwrap_or_default()
+                                .to_string(),
+                            location: p
+                                .get("location")
+                                .and_then(|v| v.as_str())
+                                .unwrap_or("query")
+                                .to_string(),
+                            param_type: p
+                                .get("param_type")
+                                .and_then(|v| v.as_str())
+                                .map(String::from),
+                            example_value: p
+                                .get("example_value")
+                                .and_then(|v| v.as_str())
+                                .map(String::from),
                         });
                     }
                 }
@@ -38,8 +62,14 @@ impl AuthBypassTool {
                     url,
                     method,
                     parameters,
-                    content_type: ep.get("content_type").and_then(|v| v.as_str()).map(String::from),
-                    requires_auth: ep.get("requires_auth").and_then(|v| v.as_bool()).unwrap_or(false),
+                    content_type: ep
+                        .get("content_type")
+                        .and_then(|v| v.as_str())
+                        .map(String::from),
+                    requires_auth: ep
+                        .get("requires_auth")
+                        .and_then(|v| v.as_bool())
+                        .unwrap_or(false),
                 });
             }
         }
@@ -96,35 +126,37 @@ impl PentestTool for AuthBypassTool {
         &'a self,
         input: serde_json::Value,
         context: &'a PentestToolContext,
-    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = Result<PentestToolResult, CoreError>> + Send + 'a>> {
+    ) -> std::pin::Pin<
+        Box<dyn std::future::Future<Output = Result<PentestToolResult, CoreError>> + Send + 'a>,
+    > {
         Box::pin(async move {
-        let endpoints = Self::parse_endpoints(&input);
-        if endpoints.is_empty() {
-            return Ok(PentestToolResult {
-                summary: "No endpoints provided to test.".to_string(),
-                findings: Vec::new(),
-                data: json!({}),
-            });
-        }
+            let endpoints = Self::parse_endpoints(&input);
+            if endpoints.is_empty() {
+                return Ok(PentestToolResult {
+                    summary: "No endpoints provided to test.".to_string(),
+                    findings: Vec::new(),
+                    data: json!({}),
+                });
+            }
 
-        let dast_context = DastContext {
-            endpoints,
-            technologies: Vec::new(),
-            sast_hints: Vec::new(),
-        };
+            let dast_context = DastContext {
+                endpoints,
+                technologies: Vec::new(),
+                sast_hints: Vec::new(),
+            };
 
-        let findings = self.agent.run(&context.target, &dast_context).await?;
-        let count = findings.len();
+            let findings = self.agent.run(&context.target, &dast_context).await?;
+            let count = findings.len();
 
-        Ok(PentestToolResult {
-            summary: if count > 0 {
-                format!("Found {count} authentication bypass vulnerabilities.")
-            } else {
-                "No authentication bypass vulnerabilities detected.".to_string()
-            },
-            findings,
-            data: json!({ "endpoints_tested": dast_context.endpoints.len() }),
-        })
+            Ok(PentestToolResult {
+                summary: if count > 0 {
+                    format!("Found {count} authentication bypass vulnerabilities.")
+                } else {
+                    "No authentication bypass vulnerabilities detected.".to_string()
+                },
+                findings,
+                data: json!({ "endpoints_tested": dast_context.endpoints.len() }),
+            })
         })
     }
 }