fix: preserve malformed citation evidence

[759132989-crypto]

What & why

Closes #24. Preserve malformed citation evidence instead of filtering it out during parsing. This change was prepared with AI assistance and locally tested.

Changes

• Pass raw JSON citation entries from parsing to verification.
• Accept only in-range JSON integers as citations; retain invalid entries without coercion.
• Let the API response serialize raw dropped entries without validation failures or type coercion.
• Escape raw dropped entries when rendering the CLI so markup-like strings neither crash nor disappear.
• Add failing-first generation, response-serialization and isolated CLI-rendering regression tests.

Compatibility note: numeric strings such as "1" are now rejected and recorded, following the issue's example. They were previously coerced to integers.

Validation

• Before the implementation: 11 new tests failed; 9 existing generation tests passed.
• Follow-up review reproduced 2 additional CLI-rendering regressions before fixing them.
• After the implementation: python -m pytest tests/test_generate.py tests/test_response_models.py tests/test_cli_citations.py -q — 22 passed.
• git diff --check — passed.
• Full Postgres/pgvector integration suite and live-model evaluation: not run. Existing lint/format findings remain; this is not a claim that CI passed.

Checklist

• Focused change with a clear description
• Ran full format / lint / tests (focused validation and limitations detailed above)
• Linked related issue
• Documentation / CHANGELOG: no separate update; compatibility change documented above.

[github-actions]

Welcome, @759132989-crypto, and thanks for your first pull request to VaultRAG.

A quick look at CONTRIBUTING.md covers how things are set up and run here.

I'll review this shortly. Ask anything in the thread if something is unclear.

[github-actions]

Nice work @759132989-crypto, this is merged.

VaultRAG gets better every time someone outside the repo digs in like this.

If you find VaultRAG useful, consider dropping a star. It helps more people find it.

Happy to see more from you whenever you have the time.