Static asset checker

Every finding here is a heuristic over one page's HTML, read from tags, never from a rendered page: scripts injected by JavaScript, assets behind a client-side router, and the viewport fold are all invisible. The proxy hands back at most the first 4,096 characters of each response body, so a larger page is checked on that prefix and the report says so. Findings stop at 10 items each; the true count sits beside the list. A clean report means nothing flagged in what was scanned, not a fast page.