Security audit report builder

It reads one version 1 audit JSON export and writes a masked report you can hand to someone else: a self-contained HTML document that prints to PDF from your browser's print dialog, plus Markdown and JSON for other systems. Checks that did not run are listed as gaps by name, never counted as passes, and the scope section states what an external configuration audit cannot see: authentication, authorization, and business logic. Masking is a pattern pass, not a secret scanner; it rewrites the shapes it knows, and with masking off the report says exactly which categories carry raw values. Dates come from the export itself and the score is whatever the audit stated, nothing invented.