Python fp and docs updtes (#58)

* refactor: Update comments for clarity and add expectations.json files for performance metrics

* feat: Implement FP guard for JS/TS local-collection receivers to suppress missing ownership checks

* feat: Enhance Rust parameter handling to classify local collections and prevent false ownership checks

* refactor: Simplify code formatting for better readability in multiple files

* refactor: Improve UTF-8 sequence length handling and enhance clarity in loop iteration

* feat: Update Java and Python patterns to include new security rules

* refactor: Improve comment clarity and consistency across multiple Rust files

* refactor: Simplify code formatting for improved readability in integration tests and module files

* refactor: Improve comment formatting and enhance clarity in assertions across multiple files

src/auth_analysis/extract/axum.rs

@@ -384,8 +384,8 @@ fn classify_rocket_param(
 ///
 /// **Looser than [`super::common::is_self_actor_type_text`] by
 /// design.**  This recogniser runs only on the type of a route-bound
-/// parameter — appearing in a route handler signature is itself a
-/// strong signal — and a false positive here just over-credits the
+/// parameter, appearing in a route handler signature is itself a
+/// strong signal, and a false positive here just over-credits the
 /// route with a login guard, which is conservative w.r.t. flagging.
 /// `is_self_actor_type_text` runs on every parameter, including in
 /// non-route functions, and a false positive there suppresses
@@ -625,6 +625,11 @@ pub(crate) fn inject_guard_checks(
             line,
             args: call.args.clone(),
             condition_text: None,
+            // Route-level guard injected from a tower / axum layer
+            // (`RequireAuthorizationLayer`, `axum_login::login_required!`,
+            // …).  Tells `auth_check_covers_subject` to short-circuit
+            // for any non-login-guard match.
+            is_route_level: true,
         });
     }
 }