feat: pentest onboarding — streaming, browser automation, reports, user cleanup (#16)

Complete pentest feature overhaul: SSE streaming, session-persistent browser tool (CDP), AES-256 credential encryption, auto-screenshots in reports, code-level remediation correlation, SAST triage chunking, context window optimization, test user cleanup (Keycloak/Auth0/Okta), wizard dropdowns, attack chain improvements, architecture docs with Mermaid diagrams.

Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com>
Reviewed-on: #16

docs/features/pentest.md

@@ -15,17 +15,47 @@ The dashboard shows:
 
 ## Starting a Pentest Session
 
-1. Click **New Pentest** on the dashboard
-2. Select a **DAST target** (must be configured under DAST > Targets first)
-3. Choose a **strategy**:
+Click **New Pentest** on the dashboard to open the 4-step onboarding wizard:
+
+### Step 1 — Target & Scope
+
+- **App URL** — enter manually or select from existing DAST targets (dropdown)
+- **Git Repository URL** — enter manually or select from tracked repositories (dropdown). If an SSH URL is selected, the deploy key is displayed for easy copy
+- **Branch / Commit** — auto-populated when you click **Lookup** for a tracked repo
+- **App Type** and **Rate Limit**
+
+### Step 2 — Authentication
+
+- **None** — unauthenticated testing
+- **Manual Credentials** — provide username/password (encrypted at rest with AES-256-GCM)
+- **Auto-Register** — the orchestrator uses the browser tool (headless Chrome) to discover the registration page and create a test account:
+  - **Registration URL** (optional) — auto-discovered via Playwright if omitted
+  - **Verification Email** (optional) — override the agent's default mailbox. Uses plus-addressing (`base+sessionid@domain`) and polls IMAP for verification links
+  - **IMAP Settings** — collapsible section to override host/port/credentials
+
+### Step 3 — Strategy & Instructions
 
 | Strategy | Description |
 |----------|-------------|
 | **Comprehensive** | Full-spectrum test covering recon, API analysis, injection testing, auth checks, and more |
-| **Focused** | Targets specific vulnerability categories based on initial reconnaissance |
+| **Quick** | Focus on common/high-impact vulnerabilities with minimal tool invocations |
+| **Targeted** | SAST-guided — prioritize areas where static analysis found issues |
+| **Aggressive** | Maximum payloads, attempt full exploitation |
+| **Stealth** | Minimal noise, passive analysis, targeted probes |
 
-4. Optionally provide an initial **message** to guide the AI's focus
-5. Click **Start** to begin the session
+- **Initial Instructions** — free-text guidance for the AI
+- **Scope Exclusions** — paths to skip
+- **Max Duration**, **Tester Name/Email**, **Destructive Tests** toggle
+
+### Step 4 — Disclaimer & Confirm
+
+Review the configuration summary and accept the authorization disclaimer.
+
+The wizard can be closed at any time via the **X** button (top-right corner) or by clicking outside the modal.
+
+::: tip Architecture Deep-Dive
+See [Pentest Orchestration Architecture](./pentest-architecture.md) for details on how the LLM loop works, what context is passed, and how findings are correlated to source code.
+:::
 
 The AI orchestrator will autonomously select and execute security tools in phases, using the output of each phase to inform the next.
 
@@ -65,9 +95,11 @@ A visual DAG (directed acyclic graph) showing the sequence of tools executed dur
 - **Finding badges** — red badge showing the number of findings produced by each tool
 - **Interactive** — hover for details, click to select, scroll to zoom, drag to pan
 
-### Stopping a Session
+### Pausing, Resuming & Stopping
 
-Running sessions can be stopped from the dashboard by clicking the **Stop** button on the session card. This immediately halts all tool execution.
+- **Pause** — click the **Pause** button on a running session to suspend the orchestrator loop. The session status changes to `paused` and the LLM stops iterating. SSE clients receive a `paused` event.
+- **Resume** — click **Resume** on a paused session to continue from where it left off. The status returns to `running` and a `resumed` event is broadcast.
+- **Stop** — click **Stop** to permanently halt the session. This marks it as `failed` with reason "Stopped by user".
 
 ## Exporting Reports