Ship basic detectors on the shared taint engine #23

Detectors consume generic facts and never framework-specific ones.

• Security detectors: sql_injection, command_injection, path_traversal, ssrf, xss (TaintDetector base)
• Syntax detectors: dangerous_eval, weak_crypto (SymbolCallDetector base over the SSA form, alias-aware)
• Each detector is a plugin with a manifest declaring requires and provides (e.g. vulnerability.sql-injection)
• End-to-end fixture: a model plugin providing HTTP sources and SQL/HTML sinks + taint + SQLInjectionDetector + SARIF (framework-specific Flask and SQLAlchemy models arrive with Phase 7)

Reference: docs/architecture.md §15 Analysis Providers and Detectors, §25 Plugin Types, §35–§36 examples.

Delivery: #24