summit v0.6.4 - redirect-following spider, TLS audit

A false-negative reduction pass plus a new standalone audit command.

Spider follows redirects

The crawler previously dropped endpoints behind 302s - a systematic false-negative source (whole app sections live behind login redirects). Crawl GETs now follow redirect chains; active checks keep allow_redirects=False because probe semantics demand it.

summit tls <host> - certificate and protocol audit

Connects once, reads the served certificate, and checks what actually bites:

• expired certificate (CWE-295, confirmed - dates do not lie)
• certificate expiring within 14 days (low, potential)
• self-signed certificate (CWE-295, confirmed - issuer equals subject)
• TLSv1.0 / TLSv1.1 handshakes accepted (CWE-326, confirmed - we complete those handshakes ourselves)

Standalone by design: it talks to the network by definition, so it is a command, not a scan phase. Verdict logic is pure and unit-tested; certificate decoding is stdlib-only.

73 tests, evidence 21/21. CI green.