Add recon upload hunter and admin surface probing for owned-target scans.

Extend web crawl with multipart/drag-drop/JS upload ranking and probe common admin paths for 200 vs 401/403 signals in scan JSON.

server/internal/recon/crawl.go

@@ -25,6 +25,9 @@ func Crawl(host string, port int, scheme string, seedPaths []string) (*CrawlRepo
 	}
 
 	report := &CrawlReport{}
+	var uploadRaw []UploadHunterFinding
+	var jsQueue []string
+	jsSeen := map[string]bool{}
 	var headerSnaps []HTTPHeaderSnap
 	var htmlBodies []string
 	visited := map[string]bool{}
@@ -65,6 +68,9 @@ func Crawl(host string, port int, scheme string, seedPaths []string) (*CrawlRepo
 		report.URLFields = append(report.URLFields, fields...)
 		report.SSRFScore += pageScore
 		report.CMSFingerprints = mergeCMS(report.CMSFingerprints, cms)
+		uploadRaw = append(uploadRaw, collectUploadFromPage(item.url, files, multi)...)
+		uploadRaw = append(uploadRaw, detectDragDropZones(item.url, body)...)
+		collectUploadJSAtDepth(base, item.url, body, item.depth, DefaultCrawlDepth, jsSeen, &jsQueue)
 
 		if item.depth >= DefaultCrawlDepth {
 			continue
@@ -89,6 +95,7 @@ func Crawl(host string, port int, scheme string, seedPaths []string) (*CrawlRepo
 	}
 	report.CMSFingerprints = mergeCMS(nil, report.CMSFingerprints)
 	report.Stack = BuildStack(headerSnaps, htmlBodies)
+	report.UploadHunter = finalizeUploadHunter(base, uploadRaw, jsQueue)
 	return report, nil
 }