fix(windows-memory): classify pages after masking protection modifiers

[Karib0u]

Closes #613

Changes

• New src/memory/protection.rs: masks the base protection (low byte) from the modifier bits, then classifies. Guard is checked first, then no-access, then readable bases. Pure u32 logic, so the unit tests run on every host.
• src/memory/windows.rs uses it in place of the exact-match is_readable/is_writable/is_executable.
• A per-process debug summary: eligible, excluded_protection, excluded_kind (never read) versus read_failed.
• docs/configuration.md documents which committed Windows regions are scanned.

Testing

• Unit tests: every readable base with and without PAGE_NOCACHE, PAGE_WRITECOMBINE, and PAGE_TARGETS_INVALID; guard excluded for every base; no-access and execute-only excluded.
• cargo test --lib memory:: passes on macOS; cargo clippy --target x86_64-pc-windows-gnu --all-targets -- -D clippy::all is clean.
• Not done: the Windows VM check from the acceptance criteria (a real modified page considered for scanning). That still needs a run on lab-windows.

[Karib0u]

Windows VM check done on lab-windows: cargo test --lib memory:: passes (12/12), including two new in-process tests that commit real pages and check whether the reader returns them. Pages with PAGE_NOCACHE and PAGE_WRITECOMBINE are scanned; PAGE_GUARD and PAGE_NOACCESS pages are not.