Fix cross-reference source failure reporting

[JordanCoin]

Closes #71

Summary

• distinguish successful checks, failures, and rate-limit skips for each source/entity
• surface redacted source error types in the CLI and saved JSON reports
• retain incomplete source status in JSON and avoid logging investigated names or raw errors

Testing

• python -m pytest tests/test_crossref_status.py tests/test_security_egress_research.py tests/test_security_egress_cli.py tests/test_security_hardening.py -v (65 passed; one existing FastAPI/Starlette deprecation warning)
• ruff check and ruff format --check
• git diff --check

Review

Independent review passed after two correction rounds; it specifically verified rate-limit and local ICIJ failures are no longer represented as clean no-match results.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.