[SizzleUnrlsd]

Summary

Framework item of #70: Tornado and Bottle models, with the call-graph work class-based handlers needed.

• Acceptance tests first (test: define the Tornado and Bottle models), implementation follows.
• tornado-models: RequestHandler and WebSocketHandler subclasses are entry points; the inherited request methods (get_argument, get_body_argument, request, cookies) are HTTP sources; write and finish are HTML sinks, redirect a redirect sink (target only), xhtml_escape a sanitizer; the HTTP clients are SSRF sinks with untrusted responses.
• bottle-models: @route, @get, @post and the methods of a Bottle application are entry points, bottle.request the source, redirect, static_file (filename only), template (the template, not its variables) and HTTPResponse sinks, html_escape a sanitizer.
• Call graph: an attribute a module class does not define is inherited, so self.get_argument in a handler denotes tornado.web.RequestHandler.get_argument, and self.request in a Django class-based view denotes View.request, now a source. Student.create(...) on the class itself resolves to the static or class method, which was an unknown target before. A @staticmethod is recorded as such in its summary so callers pass no receiver: the dvpwa SQL injection was reached through the wrong argument until now.
• Taint: a container literal passed to a sink (self.write({...}), HTMLResponse(headers={...})) is serialised by every framework, never rendered, so it carries no HTML; the FastAPI template loses a headers-dict false positive and nothing else in the corpus moves.
• Cache format 4 (summaries carry static); 30 bundled plugins; usage guide updated.

Part of #70.