VAmPI row 9 (JWT weak signing key) may be permanently unverifiable — consider reclassifying

Tracked in docs/TRACEABILITY.md, VAmPI row 9.

VAmPI's own documentation doesn't name an endpoint or mechanism for its "JWT weak signing key" vulnerability — there's nothing to verify against without guessing at what the target's own docs meant. This isn't a tool gap; it's a documentation gap on VAmPI's side, similar in spirit to the 🚫 Not in Scope items added in #113, but for a different reason (target-side ambiguity rather than tool-category mismatch).

Worth deciding whether this gets its own explicit tag/note distinguishing "we can't verify because the target never told us what to check" from a genuine miss, so the 58-item ceiling is understood accurately rather than implying all 58 are equally closeable.

Start with docs/TRACEABILITY.md and inspect VAmPI row 9, then compare the proposed distinction with the Not in Scope items added in #113. Determine whether the existing documentation supports a separate tag or note for target-side ambiguity; done means the classification decision and its traceability wording are recorded.