SecurityAgent pentest fixture

• /users - list all users (no auth)
• /user?id=1 - lookup by id (IDOR)
• /search?name=alice - search (SQLi)