feat: add unit, integration, and functional test coverage for all 9 MOADs

Each MOAD now has a synthetic defective specimen and fixed specimen
proven from first principles across three test tiers:

Unit (tests/unit/Moad000X*.java):
  - Correctness: defective and fixed produce identical functional output
  - Defect behavior: defective specimen exhibits the defect (measurable)
  - Fix behavior: fixed specimen eliminates the defect

Integration (tests/integration/AllMoadsIntegrationTest.java):
  - All 9 MOADs proven at medium scale (N=500-2000)
  - MOAD-0001: O(N^2) vs O(N) list scan at N=1000
  - MOAD-0002: 500 sessions trample each other (defective) vs coexist (fixed)
  - MOAD-0003: 250 anonymous requests leak auth identity (defective) vs zero (fixed)
  - MOAD-0004: 3000 credential exposures across 1000 requests (defective) vs zero (fixed)
  - MOAD-0005: 500 computes for 500 concurrent misses vs exactly 1
  - MOAD-0006: all 500 passwords extractable from DB (defective) vs unextractable (fixed)
  - MOAD-0007: N=2000 spatial objects, defective visits all 2000 vs O(log N + k)
  - MOAD-0009: 990 wasted firings for 1000 ticks / 10 events vs zero waste
  - MOAD-0011: 10240 NFA steps vs 13 steps on N=12 adversarial input (788x)

Functional (tests/functional/AllMoadsFunctionalTest.java):
  - MOAD-0005: real-thread contention proves herd (defective >1 compute, fixed exactly 1)
  - MOAD-0007: N=50000 spatial objects, 50M defective probes vs 516K fixed (97x speedup)
  - MOAD-0009: 10000 ticks / 10 events, 9990 wasted firings vs zero (1000x ratio)
  - MOAD-0011: N=16 adversarial, 163840 defective steps vs 17 fixed (9638x ratio)

Support algorithms (tests/support/Moad000X*.java):
  - Moad0002Algorithm: shared mutable global state (DefectiveAudioSystem / FixedAudioSystem + Context)
  - Moad0003Algorithm: ThreadLocal not cleared (handleDefective / handleFixed with finally)
  - Moad0004Algorithm: HTTP headers logged verbatim (logDefective / logFixed with CREDENTIAL_HEADERS denylist)
  - Moad0005Algorithm: get+null+compute+put (DefectiveCache HashMap / FixedCache ConcurrentHashMap.computeIfAbsent)
  - Moad0006Algorithm: Base64 password storage (DefectiveCredentialStore / FixedCredentialStore SHA-256+salt)
  - Moad0007Algorithm: linear spatial scan (queryDefective list / queryFixed sorted array + binary search)
  - Moad0009Algorithm: timer-driven polling (runDefectiveScheduler / runFixedEventDriven)
  - Moad0011Algorithm: PCRE nested quantifiers (matchDefective backtracking NFA / matchFixed linear NFA)

Makefile: added unit-moad-0002 through unit-moad-0011 targets,
integration-all-moads, functional-all-moads. integration and functional
targets now depend on all-MOADs variants.

tests/support/Moad0004Algorithm.java

@@ -0,0 +1,95 @@
+package support;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * MOAD-0004: A Logged Secret.
+ *
+ * Defect: HTTP request headers are serialized to a log string verbatim.
+ * Authorization, Cookie, X-API-Key, and Proxy-Authorization headers contain
+ * bearer tokens and session credentials.  Once logged, these persist across
+ * restarts, propagate through log aggregation pipelines, and remain readable
+ * for weeks at retention-period scale.
+ *
+ * Fix: apply a credential denylist at the log-serialization layer.
+ * Redact or omit headers whose names match known credential carriers.
+ * Functional behavior (routing, auth checks) is unaffected.
+ *
+ * Scanner detects: header-map serialization (toString, stream map, for-each
+ * with string append) without a denylist filter on known credential header names.
+ */
+public class Moad0004Algorithm {
+
+    /** Headers that carry credentials and must never appear in logs. */
+    public static final Set<String> CREDENTIAL_HEADERS = Set.of(
+        "authorization",
+        "cookie",
+        "x-api-key",
+        "proxy-authorization",
+        "x-auth-token"
+    );
+
+    /** Result of a log operation: the string written and a count of leaked credentials. */
+    public static final class Result {
+        public final String logLine;
+        public final int    credentialLeakCount;
+
+        public Result(String logLine, int credentialLeakCount) {
+            this.logLine            = logLine;
+            this.credentialLeakCount = credentialLeakCount;
+        }
+    }
+
+    // ── Defective: logs all headers verbatim ─────────────────────────────────
+
+    /**
+     * Serializes the full header map to a log line with no filtering.
+     * DEFECT: credential headers appear in cleartext in the log string.
+     */
+    public static Result logDefective(Map<String, String> headers) {
+        StringBuilder sb = new StringBuilder("REQUEST headers: ");
+        int leaks = 0;
+        for (Map.Entry<String, String> e : headers.entrySet()) {
+            sb.append(e.getKey()).append('=').append(e.getValue()).append(' ');
+            if (CREDENTIAL_HEADERS.contains(e.getKey().toLowerCase())) {
+                leaks++;
+            }
+        }
+        return new Result(sb.toString().trim(), leaks);
+    }
+
+    // ── Fixed: redacts credential headers before serialization ────────────────
+
+    private static final String REDACTED = "[REDACTED]";
+
+    /**
+     * Serializes the header map, replacing credential header values with [REDACTED].
+     * FIX: credential headers appear in the log line with redacted values.
+     * Downstream consumers still see header names (for debugging) but not values.
+     */
+    public static Result logFixed(Map<String, String> headers) {
+        StringBuilder sb = new StringBuilder("REQUEST headers: ");
+        for (Map.Entry<String, String> e : headers.entrySet()) {
+            String value = CREDENTIAL_HEADERS.contains(e.getKey().toLowerCase())
+                ? REDACTED
+                : e.getValue();
+            sb.append(e.getKey()).append('=').append(value).append(' ');
+        }
+        return new Result(sb.toString().trim(), 0);
+    }
+
+    /** Build a representative HTTP request header map for testing. */
+    public static Map<String, String> sampleHeaders() {
+        Map<String, String> h = new LinkedHashMap<>();
+        h.put("Host",          "api.example.com");
+        h.put("Content-Type",  "application/json");
+        h.put("Authorization", "Bearer eyJhbGciOiJSUzI1NiJ9.secret.token");
+        h.put("Cookie",        "session=abc123def456; csrf=xyz");
+        h.put("X-Request-Id",  "req-7f3a9c");
+        h.put("X-Api-Key",     "sk-prod-1234567890abcdef");
+        h.put("Accept",        "application/json");
+        return h;
+    }
+}