Capstone: harden a vulnerable API

Attackers do not probe one vulnerability class at a time, and fixing one hole while re-opening another is how hardening fails in practice — so the Security discipline's flagship capstone makes you fix everything at once. You are handed a small handler set seeded with the P57 vulnerability classes — an IDOR read, a mass-assignment update, and a concatenated search query — and asked to harden all of them together. The hidden suite is the abuse suite: an unauthorised document read, a privilege-escalating payload, and an injection term, and every one must fail. It also checks that legitimate requests still succeed, because over-blocking fails the capstone too — security that breaks the product isn't security.