Add LLM key-hunter toolkit, vault, and skill

- tools/scripts/llm-key-hunter: GitHub leak hunting pipeline (hunt_*,
  pivot miner, two-layer verify/content caches, per-provider verification)
- usable_keys: verified key vault across 12 providers (deepseek, minimax,
  volcanoark, longcat, codingplan, zhipu free-tier, mimo, siliconflow, etc.)
- .grok/skills/llm-key-hunter: operator skill for the hunt/verify/vault flow
- NewAPI channel import scripts and CDP capture helpers
- Result verdict buckets (excluding multi-GB blob caches and dedup dumps)

tools/scripts/capture.ps1

@@ -0,0 +1,169 @@
+<#
+.SYNOPSIS
+    One-command browser session capture.
+    Launches Chrome with CDP + starts the capture tool in one shot.
+
+.DESCRIPTION
+    This script does everything:
+      1. Launches Chrome with --remote-debugging-port
+      2. Waits for CDP endpoint to be ready
+      3. Starts the Node.js capture tool
+      4. On Ctrl+C, saves cookies/storage and cleans up
+
+.PARAMETER UseRealProfile
+    Use your real Chrome profile (logins, cookies, sessions).
+    WARNING: Existing Chrome will be closed first.
+
+.PARAMETER Port
+    CDP port (default: 9222)
+
+.PARAMETER Url
+    Starting URL (default: about:blank)
+
+.PARAMETER Screenshot
+    Take screenshot on each navigation
+
+.PARAMETER Dom
+    Save DOM snapshot on each navigation
+
+.PARAMETER Bodies
+    Capture response bodies (heavy)
+
+.PARAMETER AllTabs
+    Capture all tabs (default: first tab only)
+
+.PARAMETER Filter
+    Only capture network requests matching this regex
+
+.PARAMETER NoInteractions
+    Disable interaction capture
+
+.PARAMETER NoNetwork
+    Disable network capture
+
+.PARAMETER NoConsole
+    Disable console capture
+
+.EXAMPLE
+    .\capture.ps1 -UseRealProfile
+    Launch Chrome with your real profile and start capturing
+
+.EXAMPLE
+    .\capture.ps1 -UseRealProfile -Screenshot -Dom -AllTabs
+    Full capture: all tabs, screenshots, DOM snapshots
+
+.EXAMPLE
+    .\capture.ps1 -UseRealProfile -Url "https://example.com" -Filter "/api/"
+    Start at example.com, only capture API calls
+#>
+
+param(
+    [switch]$UseRealProfile,
+    [int]$Port = 9222,
+    [string]$Url = "about:blank",
+    [switch]$Screenshot,
+    [switch]$Dom,
+    [switch]$Bodies,
+    [switch]$AllTabs,
+    [string]$Filter = "",
+    [switch]$NoInteractions,
+    [switch]$NoNetwork,
+    [switch]$NoConsole
+)
+
+$ErrorActionPreference = "Stop"
+$projectRoot = Resolve-Path "$PSScriptRoot\..\.."
+$chromePath = "C:\Program Files\Google\Chrome\Application\chrome.exe"
+$captureScript = "$PSScriptRoot\cdp-capture\capture.js"
+
+# ─── Find Chrome ─────────────────────────────────────────────
+if (-not (Test-Path $chromePath)) {
+    $altPaths = @(
+        "$env:ProgramFiles\Google\Chrome\Application\chrome.exe",
+        "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
+        "$env:LOCALAPPDATA\Google\Chrome\Application\chrome.exe"
+    )
+    foreach ($p in $altPaths) { if (Test-Path $p) { $chromePath = $p; break } }
+    if (-not (Test-Path $chromePath)) {
+        Write-Host "❌ Chrome not found!" -ForegroundColor Red
+        exit 1
+    }
+}
+
+# ─── Determine profile ───────────────────────────────────────
+if ($UseRealProfile) {
+    $procs = Get-Process chrome -ErrorAction SilentlyContinue
+    if ($procs) {
+        Write-Host "⚠️  Closing existing Chrome to use your real profile..." -ForegroundColor Yellow
+        Stop-Process -Name chrome -Force -ErrorAction SilentlyContinue
+        Start-Sleep -Seconds 2
+    }
+    $userDataDir = "$env:LOCALAPPDATA\Google\Chrome\User Data"
+} else {
+    $userDataDir = "$env:LOCALAPPDATA\Google\Chrome\Capture-Profile"
+}
+
+# ─── Banner ──────────────────────────────────────────────────
+Write-Host ""
+Write-Host "╔══════════════════════════════════════════════════╗" -ForegroundColor Cyan
+Write-Host "║        One-Shot Browser Session Capture           ║" -ForegroundColor Cyan
+Write-Host "╚══════════════════════════════════════════════════╝" -ForegroundColor Cyan
+Write-Host ""
+Write-Host "  Port:    $Port" -ForegroundColor White
+Write-Host "  Profile: $(if ($UseRealProfile) { 'Real (your logins)' } else { 'Fresh capture profile' })" -ForegroundColor White
+Write-Host "  URL:     $Url" -ForegroundColor White
+Write-Host ""
+
+# ─── Step 1: Launch Chrome ───────────────────────────────────
+Write-Host "[1/2] Launching Chrome..." -NoNewline -ForegroundColor Cyan
+
+$chromeArgs = @(
+    "--remote-debugging-port=$Port",
+    "--user-data-dir=`"$userDataDir`"",
+    "--no-first-run",
+    "--no-default-browser-check",
+    $Url
+)
+$chromeProc = Start-Process -FilePath $chromePath -ArgumentList $chromeArgs -PassThru
+
+# Wait for CDP
+$ready = $false
+for ($i = 0; $i -lt 30; $i++) {
+    Start-Sleep -Milliseconds 500
+    try {
+        Invoke-RestMethod -Uri "http://localhost:$Port/json/version" -ErrorAction Stop | Out-Null
+        $ready = $true; break
+    } catch {}
+}
+if (-not $ready) { Write-Host " FAILED" -ForegroundColor Red; exit 1 }
+Write-Host " Ready!" -ForegroundColor Green
+
+# ─── Step 2: Start capture ───────────────────────────────────
+Write-Host "[2/2] Starting capture..." -ForegroundColor Cyan
+Write-Host "      Press Ctrl+C to stop and save session data." -ForegroundColor DarkGray
+Write-Host ""
+
+# Build node args
+$nodeArgs = @("capture.js", "--port=$Port")
+if ($Screenshot)      { $nodeArgs += "--screenshot" }
+if ($Dom)             { $nodeArgs += "--dom" }
+if ($Bodies)          { $nodeArgs += "--bodies" }
+if ($AllTabs)         { $nodeArgs += "--tab=-1" }
+if ($Filter -ne "")   { $nodeArgs += "--filter=$Filter" }
+if ($NoInteractions)  { $nodeArgs += "--no-interactions" }
+if ($NoNetwork)       { $nodeArgs += "--no-network" }
+if ($NoConsole)       { $nodeArgs += "--no-console" }
+
+# Run capture in foreground — Ctrl+C will stop it
+Push-Location "$PSScriptRoot\cdp-capture"
+try {
+    & node $nodeArgs
+} finally {
+    Pop-Location
+    # Clean up Chrome if it's still running
+    if ($chromeProc -and -not $chromeProc.HasExited) {
+        Write-Host ""
+        Write-Host "Closing Chrome..." -ForegroundColor DarkGray
+        Stop-Process -Id $chromeProc.Id -Force -ErrorAction SilentlyContinue
+    }
+}