fix: use configured model for API validation instead of hardcoded deprecated model

[theLightArchitect]

Summary

Fixes a two-layer bug where FindingsFilter silently disables Claude-based filtering due to a hardcoded deprecated model string.

Root cause analysis:

validate_api_access() hardcoded "claude-3-5-haiku-20241022" instead of using self.model. When this deprecated model fails API validation, filtering silently disables with only a logger.warning() — no user-visible indication.

initialize_findings_filter() did not pass the model parameter to FindingsFilter, so even when users configure CLAUDE_MODEL env var, it never reaches the ClaudeAPIClient used for filtering (though it correctly reaches SimpleClaudeRunner for the main audit).

Fix (2 source files + 1 test update + 1 new test file):

• claude_api_client.py: Use self.model in validate_api_access() instead of hardcoded string
• github_action_audit.py: Pass model=DEFAULT_CLAUDE_MODEL to FindingsFilter initialization
• test_helper_functions.py: Update existing test to expect the new model parameter
• test_model_configuration.py: 5 new tests verifying model propagation and warning behavior

Note: findings_filter.py already accepts the model parameter — this PR wires the missing upstream call sites.

Why self.model instead of a new constant: Using self.model means validation always uses whatever model the user configured, with zero new constants to maintain.

Backward compatible: The CLAUDE_MODEL env var and DEFAULT_CLAUDE_MODEL constant continue to work as before.

Test plan

• All existing tests pass
• New tests verify self.model is used (not hardcoded string)
• New tests verify model flows from initialize_findings_filter() → FindingsFilter → ClaudeAPIClient
• New tests verify ::warning:: annotation on validation failure

Closes #69