VAG Connect v2.10.11

Data Act portal SPA: 3 new state-extraction patterns + 2-source forensic dump.

What's new

Data Act portal SPA password page (#388 swebachus v2.10.10 trace). swebachus's v2.10.10 warning log showed the portal returns a pure-SPA shell as the password page: <input absent, state substring present, __STORE__ absent. Three new extraction patterns target what this means:
- Auth0 native state signature: regex for hKFo[A-Za-z0-9_\-\.]{40,}. Auth0 state tokens always start with hKFo (base64 of the msgpack 0x84a1 marker for a 4-element map with first 1-byte string key) so they are catchable even when the bundle inlines them as bare string literals without any state: marker.
- Escaped JSON \"state\":\"...\" for double-encoded inline payloads.
- URL-encoded state in body for window.location = "...state=X..." inline patterns.
Forensic warning now covers landing_html (not just password_html), prints the raw URL strings, and dumps a 110-char context window around any state substring so the next failing trace pinpoints exactly where the token lives or proves the page is purely JS-rendered post-bundle.