F32 zero-click + offline RT harvest — evil-poc

Attacker origin:

idle

Token set (P1)

waiting for token...

P3 probe: account API with evil-poc access token

not probed yet — browser CORS may block; server-side probe preferred