Browse passive auth reports and trace claims to raw evidence

[justsml]

Parent

#21

What to build

Make passive-auth reports reviewable in the existing artifact experience with bounded forensic drill-down to source evidence.

Acceptance criteria

• An operator can open a report and review target, route groups, confidence, blockers, unknowns, and categorized next steps.
• Every claim exposes its raw artifact IDs through an explicit bounded and redacted reveal path.
• Binary or unavailable evidence is represented calmly and cross-project reads return 404.
• Reload preserves the view and no UI action runs a probe.
• A human reviews the information hierarchy and raw-evidence wording before merge.

Blocked by

• Persist passive auth summaries through the canonical artifact and RAG pipeline #163

[justsml]

Completed and shipped in #183. The merged report browser provides bounded summary-first viewing, explicit raw-evidence reveal, calm missing/binary states, and canonical project/task attribution.