Ten-phase authorized API hunting methodology (BOLA/IDOR/BFLA, JWT and
OAuth, GraphQL abuse, input validation, logic, rate-limit trust
confusion, data exposure) as the hunting counterpart of api-recon.
Adapted from zhaoxuya520/reverse-skill skills/api-security (MIT).
Refs #76
