fix: broken /api/visual/* routes + /api/command PATH (issues #001, #002); add WEP methodology doc

Summary

Two bugs found while driving HexStrike for a Wi-Fi airspace assessment. Both are fixed in this PR.

#001 — /api/visual/* routes call methods on the wrong class (HTTP 500)

POST /api/visual/vulnerability-card, POST /api/visual/summary-report, and POST /api/visual/tool-output all raise and return HTTP 500 on every call. They reference render_vulnerability_card / create_summary_report / format_tool_output on ModernVisualEngine, but those methods are actually @staticmethods defined on CVEIntelligenceManager. ModernVisualEngine only has a different method (format_vulnerability_card, note format_ not render_).

Fix: reference CVEIntelligenceManager at the three call sites (and drop the unnecessary ModernVisualEngine() instantiation in the summary-report route).

Repro before:

curl -X POST .../api/visual/vulnerability-card -d '{"title":"x","severity":"CRITICAL","description":"y"}'
-> {"error":"Server error: type object 'ModernVisualEngine' has no attribute 'render_vulnerability_card'"}

After: {"success": true, "vulnerability_card": "..."}.

This also unblocks the MCP tools create_vulnerability_report, format_tool_output_visual, and create_scan_summary, which map to these routes.

#002 — /api/command cannot find tools in /usr/sbin under minimal-PATH launchers

EnhancedCommandExecutor.execute() uses subprocess.Popen(shell=True) with no env=, inheriting the parent PATH verbatim. When the server runs under a service manager with a minimal PATH (typical systemd unit: /usr/bin:/bin), every tool in /usr/sbin or /usr/local/sbin — the entire aircrack-ng suite (airmon-ng, airodump-ng, aireplay-ng), tcpdump, etc. — fails with command not found.

Worse, GET /health advertises these tools as available (it resolves them with shutil.which() / absolute probing that doesn't depend on PATH), so clients see a silent inconsistency: health says usable, /api/command says not found.

Fix: augment PATH at module import to include /usr/sbin, /usr/local/sbin, /sbin, /usr/local/bin. Minimal, least-invasive.

Repro before: POST /api/command {"command":"airmon-ng start wlan1"} -> sh: 1: airmon-ng: not found After: which airodump-ng airmon-ng aircrack-ng -> resolves correctly.

Follow-up (out of scope here): tools_status in /health should reflect executability under the same PATH execute_command uses.

Docs

• docs/issues/001-visual-api-routes-call-wrong-class.md
• docs/issues/002-execute-command-PATH-missing-sbin.md
• docs/WEP_ATTACK_METHODOLOGY.md — authorized-testing reference for the active WEP attack chain (aireplay-ng fake-auth + ARP replay -> aircrack-ng -z PTW), written with an explicit authorization gate front-and-center so it can't be misused against targets the tester doesn't own. Produced as part of a Wi-Fi airspace assessment.

Verification

• python3 -m py_compile hexstrike_server.py — OK
• After restart, all three /api/visual/* endpoints return {"success": true, ...} with rendered ANSI cards.
• POST /api/command {"command":"which airodump-ng airmon-ng aircrack-ng"} -> /usr/sbin/airodump-ng, /usr/sbin/airmon-ng, /usr/bin/aircrack-ng.

Diff: hexstrike_server.py (17 insertions, 7 deletions) + new docs.

Happy to split the WEP methodology doc into a separate PR if preferred.