Add a seeded taint trace: db_query -> http_post exfiltration #4

Context

The seeded taint fixtures cover three source→sink pairs: taint_web_to_send, taint_email_to_payment, taint_file_to_shell. A db_query → http_post exfiltration path (untrusted DB row read, then POSTed to an external URL) is a distinct, realistic flow not yet exercised, and both keywords are already in the detector's default sets.

What to do

Add a seeded trace tests/fixtures/seeded/taint_db_to_http.json where a db_query (or sql_query) tool returns a row containing a secret-looking segment (≥12 chars) that then appears verbatim in an http_post sink's tool_input, with no sanitizer span between them. Add a test asserting the taint detector emits exactly one error finding over it (mirror the existing seeded-taint assertions).

Acceptance criteria

• New fixture under tests/fixtures/seeded/.
• A test asserts one taint error finding with the expected source/sink span ids.
• uv run pytest passes.

Pointers

• tests/fixtures/seeded/taint_web_to_send.json — structure to mirror
• src/taintline/detectors/taint.py:21-60 — DEFAULT_SOURCES includes db_query/sql_query; DEFAULT_SINKS includes http_post
• tests/test_taint.py — where to add the assertion
• src/taintline/detectors/taint.py:110 — _segments / min_segment_len (12) constraint