v0.2.0: be the only phone OSINT tool a user needs (zero-setup, full coverage)

## North star

A user runs `clank deep ` with **zero configuration** — no API keys, no Telegram pair, no WhatsApp QR scan — and gets richer output than they would from PhoneInfoga, ignorant, mr.phone, or any combination of free OSINT tools. They should never need to install a second phone-OSINT tool again.

That's the v0.2.0 finish line. Tracking it here so the work doesn't drift into 5 small PRs that don't add up.

## Why this matters

v0.1.0 `deep` on a real Indian number returned **2 useful signals** (libphonenumber + Amazon registered) out of 8 source categories. The other 6 were either:
- Skipped (free APIs need keys, Telegram needs login, WhatsApp needs pair)
- Broken (Snapchat — known)
- Rate-limited (Instagram)

PhoneInfoga delivers more on first run because it doesn't try to do anything that needs auth. Our "MIT, faster, more sources" pitch is hollow until we beat the no-setup baseline. Today we lose that comparison. v0.2.0 fixes it.

**Constraint:** every source we ship by default must work without keys, sessions, or pairing.

## Sources to add (no key, no session, no pair)

### Replace WhatsApp/Telegram pairing for basic checks
- [ ] **`wa.me/` probe** — public WhatsApp profile page; gives registered yes/no + display name + avatar URL. No pair required.
- [ ] **`t.me/+` probe** — Telegram public-link preview; sometimes returns username + display name without MTProto.

### Replace the 3 keyed APIs for carrier/validation
- [ ] **OVH HLR lookup** — free, unauthenticated, returns carrier + ported status.
- [ ] **NumLookupAPI public endpoint** — no key, line type + carrier.
- [ ] Free portion of veriphone via scrape, if anti-bot is manageable.

### Spam / reputation (highest user demand)
- [ ] **Truecaller scrape** — already on roadmap; the #1 thing every user wants. Plan for proxy support up front because anti-bot is real.
- [ ] **Should I Answer** — public spam database.
- [ ] **Spamcalls.net** — community-reported spam DB.

### Reverse identity (locale-aware)
- [ ] **GitHub commit search** for the number string — people leak phones in commits constantly. Free, no key.
- [ ] **India**: Justdial reverse, Truecaller IN.
- [ ] **US**: 411 / WhitePages public preview.
- [ ] **UK**: 192.com public preview.

### Public records
- [ ] **Companies House (UK)** — directors' phones are public.
- [ ] **MCA (India)** — company filings include directors' phones.
- [ ] SEC EDGAR — already done in v0.1.0.

### Breach chain
- [ ] After phone→email reverse hit (via Truecaller or public records), chain into HIBP for breach exposure on that email. HIBP needs a key but the free tier exists; document the setup, but don't make it gate basic output.

## Architecture changes

- [ ] **`deep` auto-runs `dorks` and prints the URL list at the end of every report.** No user should have to discover the second subcommand separately.
- [ ] **Source-skip messaging** — when a source skips for missing config, render it as an inline *suggestion* (\"set IPQS_KEY for fraud score\"), not as a top-level line item that makes the report look empty.
- [ ] **Locale-aware source dispatch** — if libphonenumber says IN, prioritize Indian sources; if US, prioritize US sources. Less noise per report.
- [ ] **All no-auth sources fan out in parallel.** End-to-end deep report on any number must finish in < 5s.
- [ ] **Per-source disk cache at `~/.clank/cache/` with TTL.** Re-running `deep` on the same number within 10 min hits cache, not the upstream APIs. Keeps Truecaller from rate-limiting power users.

## Acceptance criteria

Fresh install. Clean machine. No env vars. No API keys. No Telegram pair. No WhatsApp pair.

```
clank deep +14155552671
```

must return at minimum:
- Carrier (libphonenumber + OVH cross-validation)
- WhatsApp registered yes/no + display name (via wa.me)
- Spam score (Truecaller + Should I Answer)
- 2+ name attributions (Truecaller, public records, GitHub commits)
- 2+ social presence hits
- The dorks URL list inline
- Total runtime < 5s

**If we can't beat PhoneInfoga on the same number with zero setup, v0.2.0 isn't shipped.**

## Stretch (v0.3.0)

- [ ] Reverse image search on any avatar we obtain (wa.me, Truecaller) — Google Lens + TinEye dorks minimum.
- [ ] Phone → email → holehe-style multi-site enumeration chain.
- [ ] Built-in proxy rotation for anti-bot sources (Truecaller, Instagram, Amazon).
- [ ] Per-source plugin system so contributors can add country-specific sources without forking core.

## Tools we're replacing (the success metric)

A v0.2.0 user must never `brew install` any of these again because clank covers their job:
- PhoneInfoga
- ignorant
- holehe (when chained from phone)
- mr.phone
- moriarty-project
- Free Truecaller / Sync.ME web tools

If a user still reaches for one of these after installing clank, that's a v0.2.x bug — file a follow-up issue with the specific source they needed.

## Out of scope for this issue

- Truecaller paid API tier
- Anything that needs paid data feeds
- The brew tap setup (#3)
- Recording asciinema casts (separate marketing track)