refactor: modularize codebase and add 404 unit tests

Split large files into focused modules across all crates while
maintaining API compatibility via re-exports. Add comprehensive
unit tests covering core models, pipeline parsers, LLM triage,
DAST security tools, graph algorithms, and MCP parameter validation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

compliance-mcp/src/tools/dast.rs

@@ -12,6 +12,66 @@ fn cap_limit(limit: Option<i64>) -> i64 {
     limit.unwrap_or(DEFAULT_LIMIT).clamp(1, MAX_LIMIT)
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cap_limit_default() {
+        assert_eq!(cap_limit(None), DEFAULT_LIMIT);
+    }
+
+    #[test]
+    fn cap_limit_clamps_high() {
+        assert_eq!(cap_limit(Some(300)), MAX_LIMIT);
+    }
+
+    #[test]
+    fn cap_limit_clamps_low() {
+        assert_eq!(cap_limit(Some(0)), 1);
+    }
+
+    #[test]
+    fn list_dast_findings_params_deserialize() {
+        let json = serde_json::json!({
+            "target_id": "t1",
+            "scan_run_id": "sr1",
+            "severity": "critical",
+            "exploitable": true,
+            "vuln_type": "sql_injection",
+            "limit": 10
+        });
+        let params: ListDastFindingsParams = serde_json::from_value(json).unwrap();
+        assert_eq!(params.target_id.as_deref(), Some("t1"));
+        assert_eq!(params.scan_run_id.as_deref(), Some("sr1"));
+        assert_eq!(params.severity.as_deref(), Some("critical"));
+        assert_eq!(params.exploitable, Some(true));
+        assert_eq!(params.vuln_type.as_deref(), Some("sql_injection"));
+        assert_eq!(params.limit, Some(10));
+    }
+
+    #[test]
+    fn list_dast_findings_params_all_optional() {
+        let params: ListDastFindingsParams = serde_json::from_value(serde_json::json!({})).unwrap();
+        assert!(params.target_id.is_none());
+        assert!(params.scan_run_id.is_none());
+        assert!(params.severity.is_none());
+        assert!(params.exploitable.is_none());
+        assert!(params.vuln_type.is_none());
+        assert!(params.limit.is_none());
+    }
+
+    #[test]
+    fn dast_scan_summary_params_deserialize() {
+        let params: DastScanSummaryParams =
+            serde_json::from_value(serde_json::json!({ "target_id": "abc" })).unwrap();
+        assert_eq!(params.target_id.as_deref(), Some("abc"));
+
+        let params2: DastScanSummaryParams = serde_json::from_value(serde_json::json!({})).unwrap();
+        assert!(params2.target_id.is_none());
+    }
+}
+
 #[derive(Debug, Deserialize, JsonSchema)]
 pub struct ListDastFindingsParams {
     /// Filter by DAST target ID