feat: add remote hashcat backend support

[l50]

Summary

Adds an optional HTTP backend to the cracker tool. When the cracker agent has HASHCAT_SERVICE_URL (and HASHCAT_TOKEN) in its environment, crack_with_hashcat delegates to that service instead of spawning hashcat locally.

Use case: the cluster nodes have no GPU, but a separate machine on the LAN (e.g. an Apple Silicon Mac, a dedicated cracking box) is reachable and exposes a small /jobs API. The cracker agent becomes a thin client — no local hashcat binary, no GPU, no wordlist directory required.

When neither env var is set, behavior is unchanged.

Service contract

• POST /jobs with Authorization: Bearer <token> and JSON {hash_mode, attack_mode, hashes, wordlist?, mask?} returns {job_id, status}.
• GET /jobs/{id} returns {status, log_tail?, error?} where status is one of starting | running | done | error.
• GET /jobs/{id}/potfile returns {cracked: ["<hash>:<plaintext>", ...]}.

Scope

Remote mode covers wordlist attack (-a 0) against a single wordlist by basename only (the service owns its wordlist dir). Rules-based attacks and dynamic username-derived wordlists stay local-only — they depend on filesystem state that doesn't transfer to a remote service.

hashcat_mode is auto-detected from the hash prefix the same way as the local path (Kerberoasting / AS-REP / NTLM defaults), and an explicit hashcat_mode arg still overrides.

Test plan

• cargo build --package ares-tools (passes)
• cargo clippy --package ares-tools (clean)
• cargo test --package ares-tools (passes via pre-commit)
• Manual: deploy a cracker agent with HASHCAT_SERVICE_URL set against a known-good service, submit a crack_with_hashcat task via the orchestrator, confirm result returns and includes the cracked plaintext.
• Manual: deploy the agent with the env vars unset, confirm existing local subprocess path still works.

[codecov]

Codecov Report

❌ Patch coverage is 6.66667% with 98 lines in your changes missing coverage. Please review.
✅ Project coverage is 79.97%. Comparing base (db1c4ee) to head (ef4520a).

Files with missing lines	Patch %	Lines
ares-tools/src/cracker/remote.rs	4.90%	97 Missing ⚠️
ares-tools/src/cracker.rs	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #340      +/-   ##
==========================================
- Coverage   80.03%   79.97%   -0.07%     
==========================================
  Files         433      434       +1     
  Lines      125577   125682     +105     
==========================================
+ Hits       100500   100508       +8     
- Misses      25077    25174      +97     

Files with missing lines	Coverage Δ
ares-tools/src/cracker.rs	88.28% <66.66%> (-0.20%)	⬇️
ares-tools/src/cracker/remote.rs	4.90% <4.90%> (ø)

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[l50]

Closing — re-opening through the standard fabric_pr workflow.