v1.1.0

v1.1.0: scan behind a login, prove your fixes

Authenticated scanning (asked for by a user on the launch post): hand
hackable your own session cookie and the crawler plus all 14 probes run as
your logged-in session, so pages and forms behind a login get crawled and
tested too.

hackable https://your-site.com --cookie "sessionid=abc123"

• HACKABLE_COOKIE env var as an alternative to the flag (handy in CI),
  plus repeatable --header "Name: value" passthrough for bearer tokens.
• hackable never logs in for you: no passwords, no login flow, ever.
• The cookie value never appears in any output: not the terminal, not
  --json, --sarif, or --html. Reports stay clean of secrets.
• If the session looks expired (401/403 or a redirect to a login page),
  hackable warns you and scans the public site instead of failing.

Baselines and diffs: --save-baseline baseline.json snapshots a scan;
--diff-from baseline.json on the next run reports NEW and FIXED findings
plus the score change, in the terminal and in --json. Pair with cron for
scheduled scans with diff alerts, or with --fail-under as a CI gate.

Real before/after demo: demo/vulnapp_fixed.py is the hardened twin of
the intentionally vulnerable demo app. Scan vulnapp.py (scores 0/100, F),
apply the fixes the report cards suggest, scan the twin (86/100, B), and
watch a real score climb. Both numbers come from actual scans with this
release.

Test suite: 54/54 green (31 new, all against local fixtures, never a real
site).