docs: where the authenticated session is actually used
Documents the Authenticated Session Recording feature end to end, with two
real screenshots of the UI rather than placeholders.
The new depth is the consumer map: which recon modules and tools attach the
session (http_probe, resource_enum's six crawlers and fuzzers, vuln_scan,
ai_surface_recon, graphql_scan), the partial-recon equivalents, and the three
agent paths, plus what deliberately never gets it and why (GAU and ParamSpider
query third-party archives, so a session would go to the archive provider).
Also explains the two scope-enforcement models and why they differ: CLI tools
take one -H set for a whole targets file with no per-host syntax, so they fail
closed across every host, while the per-request consumers can be judged one
host at a time.
Corrects the page against the shipped product: the /traffic Record button no
longer exists, the two consumer switches were undocumented, the default scope
covers subdomains, and an anchor collided with its own parent heading. Adds
the OAST and same-host-redirect behaviour an attached session now triggers.
The diagram is greyscale with per-node text colours so it holds up on both the
light and dark themes; mermaid's defaults assume a white page.