Deepen coverage for supported languages and frameworks

[bjcorder]

Context

An audit of the implementation (sessionscope-detectors, sessionscope-classifier) and docs found that the breadth of supported targets is well chosen, but depth was uneven: some frameworks relied entirely on generic fixtures for whole categories, the Next.js session-fixation classifier silently degraded to a generic suggested fix, the seven cloud SDKs were documented as one undifferentiated bucket, docs had no vulnerable→fixed examples, and several COVERAGE_MATRIX.md claims didn't match what the code actually fires on.

Scope: depth-only within the already-supported set (Express, Next.js App Router, FastAPI, Django, generic JS/TS/Python, provider SDKs). No new frameworks/languages — the v0.3+ roadmap deferrals (Flask, Koa, Go, Rails, python-jose/Authlib-JWT, Django OAuth, Python client-storage) are explicitly preserved.

Changes

Implementation — Next.js session-fixation (the one code change)

• The transition detector was Express-route-specific (app.post/router.post), so Next.js App Router export async function POST(...) handlers were never recognized. Added an ancestor-context auth-transition path guarded to cookies() session stores, emitting handler-scoped evidence so a co-located cookies().delete() + cookies().set() reissue suppresses the review. Privilege transitions keep flowing through the existing export-statement path (no double-counting).
• Classifier framework_for() now matches "nextjs" and emits a Next.js-specific suggested fix.

Fixtures + tests (each backed by a hand-written behavioral assertion, since expected.json is metadata-only)

• nextjs/session-fixation-signals (+ JSON snapshot) — 1 login + 1 privilege finding, clear-and-reissue suppression
• fastapi/oauth-flow — Authlib static-state + unverified-callback review
• fastapi/trust-boundary, django/trust-boundary — cross-context token reuse + provider review
• express/jwt-validation — jsonwebtoken issuer/audience/expiry/decode posture
• generic-ts/sdk-auth0, generic-ts/sdk-supabase — per-SDK provider breakdown (Okta/Cognito/Azure AD/Firebase/Clerk left to a follow-up, as planned)

Documentation

• Fixed SCHEMA.md CLI version (0.1.0→0.2.0) and misleading COVERAGE_MATRIX.md rows (sliding-expiry trigger, Django Partitioned, Authlib OAuth-flow vs JWT-validation).
• Added Generic JS/TS and Generic Python sections to FRAMEWORK_COVERAGE.md (grounded in actual detector code, e.g. the exact browser-client path heuristics).
• Split cloud-SDK docs into seven per-SDK subsections and added vulnerable→fixed remediation snippets to SARIF_RULES.md.

Compatibility & safety

• No new SARIF rule IDs; the redaction trust boundary is untouched.
• The one new snapshot was added with zero churn to existing snapshots.
• New fixtures use only labelled placeholder values; rendered output was verified not to leak token values.

Verification

• cargo test --workspace → 478 tests pass, 0 failures
• cargo clippy clean on changed crates
• JSON snapshot test passes without regeneration

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}