[SizzleUnrlsd]

Summary

The three points left open on #32, the proof engine of docs/architecture.md §24, plus the plugin extension point for evidence.

• Acceptance tests first (test: define numeric, validator and authorization evidence), implementation follows.
• abstract/ranges.py: an interval domain over the SSA form. A value gets an interval when it is proven numeric (numeric constants, arithmetic on numbers, int(), len(), abs() and friends); comparisons refine both sides on the branch they take, chained comparisons and and / or included; loops converge by widening. Intervals are per block, so the refutation engine reads them at the sink.
• Refutation: a numeric value cannot inject, so a tainted origin whose every dependence path to the sink argument goes through a numeric value is refuted, with the range in the evidence (numeric value within [0, 60]). That dependence-cut check now applies to every proof, so x + str(int(x)) stays a vulnerability.
• Validator model: a callable whose truth proves its declared argument, resolved through the call graph symbols so re.fullmatch(p, x) and re.compile(p).fullmatch(x) both work. Shipped for the standard library.
• AuthorizationGuard model: a decorator or a dominating condition that restricts who reaches the sink. A flow behind one is a hotspot with the evidence behind authorization (login) by decorator or at line N; a refutation still wins. Shipped for flask_login and Django's auth decorators, so a login_required route with an injection is reported at medium confidence.
• The RefutationPlugin type of the roadmap is realised as these two models: any plugin contributes evidence through Plugin.models, the same way it contributes sources and sinks, and the engine stays the only code that reads the IR.

Closes #32