summit v0.6.1 - false-positive extermination, complete evidence

False-positive extermination pass. Three changes, each with a regression test:

• authorize guard: if the "privileged" response is itself a redirect or a content-less shell, both roles are bouncing off the same auth wall - no longer reported as broken access control. Regression test: a login wall that 302s every role is suppressed; a real admin panel is still flagged.
• SSTI guard: a page that echoes {{7*7}} literally while containing "49" elsewhere (a page number, a price) is reflection, not evaluation. The raw template must disappear for a finding. Regression test included.
• Complete evidence: finding evidence is no longer truncated anywhere - as_dict and the console report ship the full proof string. The "evidence not truncated" behavior itself has a test.

64 tests, evidence 19/19. CI green.