Verify existing checks against crAPI rows 11/13/15 (SSRF, SQLi, JWT sub-attacks) — never pointed at the specific endpoints

Tracked in docs/TRACEABILITY.md, crAPI section.

Three rows where the detection logic already exists but was never run against the specific crAPI endpoint:

• Row 11 (SSRF via video conversion): ServerSideRequestForgeryTestCase exists, wasn't pointed at crAPI's video-conversion field this round.
• Row 13 (SQL injection, coupon redemption): SqlNoSqlInjectionTestCase exists, endpoint wasn't in the tested set.
• Row 15 (JWT forgery, 3 sub-attacks — alg confusion, JKU, kid path traversal): checks exist from #99, never re-verified specifically against crAPI's real JWKS.

Likely just needs correct targeting + live verification against a self-hosted crAPI instance (docker-compose from OWASP/crAPI), not new code. Update docs/TRACEABILITY.md with results either way — if a row genuinely doesn't fire once correctly targeted, that's real signal, not just an unverified assumption.

Start with docs/TRACEABILITY.md and the crAPI section, then inspect ServerSideRequestForgeryTestCase and SqlNoSqlInjectionTestCase. Run the existing checks against a self-hosted OWASP crAPI instance using its docker-compose setup, including the JWT sub-attacks against the real JWKS. Done means documenting verification results for rows 11, 13, and 15, including any checks that do not fire.