Attribute runtime hits to live traffic (route, auth state) #69

Part of #51. "The function ran" is not the same as "live traffic reaches it". To get there, the probe tags each hit with the inbound request (or job) it ran under. That gives each SCA finding a three-step runtime state:

1. Loaded: the vulnerable package is in memory (Runtime package inventory: loaded versions, drift and live advisories #68).
2. Executed: a watched symbol was called (Python live sensor (sys.monitoring) #55, Node.js live sensor (--require hook) #56).
3. Reached from traffic: a watched symbol was called while handling an inbound request. Report which routes reached it and how often.

Probe side:

• Keep the current request context in a contextvars.ContextVar (Python) or AsyncLocalStorage (Node), set by a small framework hook:
  • Python: ASGI/WSGI middleware, with route templates from FastAPI/Starlette, Flask and Django.
  • Node: Express and Fastify (req.route.path, routeOptions.url).
• When a watched symbol is hit, add route to the hit key: "GET /users/{id}", or "job:<name>" / "startup" / "unknown" outside a request.
• Add auth to the hit key: anonymous, authenticated or unknown. Detect it from framework auth state, or from whether the request carried an Authorization header or session cookie. Never record the user ID, token or claims. This connects to the threat model's Precondition field: a vulnerable function reached anonymously ranks above one reachable only after login.
• Record only the method and route template. Never record the concrete path, query string, header or cookie values, client IP, identity or body. If no template can be resolved, use "unknown", never the raw URL.
• Also count requests per route per session, so the dashboard can show "reached on 3 of 41 routes seen".

Other runtimes: JVM (#74), .NET (#75), Go (#76), Ruby (#77) and PHP (#78) implement the same route and auth contract with their own framework hooks, listed in each issue. This issue owns the contract, the privacy rules and the Python/Node implementations.

Overhead budget: at most 1 ms p99 added latency per request, and at most 3% throughput loss on the benchmark app, with the sensor enabled and the watched function on the hot path. Put the numbers in the PR.

Done when: sample apps for FastAPI, Flask and Express produce hits with the right route templates. A test proves that path parameters and query values never appear in the output, that a background job hit gets tagged as job:, and that auth is detected correctly for anonymous and authenticated requests.