Surface dropped_citations in /ask API response and CLI

[kaminimangal]

What & why

dropped_citations was already being calculated in generate.py whenever the model cited a source that wasn't actually given to it, but it never made it out anywhere — not in the API response, not in the CLI. So if the model hallucinated a citation, there was no way to actually see that it happened (unless every single citation was fake, which triggers a full refusal already).

Changes

• Added dropped_citations to AskResponse in main.py and passed it through in the /ask endpoint
• Added a yellow warning in the CLI's _ask when there are dropped citations, same style as the existing conflict/stale warnings
• Added a test that scripts a fake citation and checks it shows up in the response

Ran the full suite locally, everything passes (58 tests).

Closes #4

Checklist

• Focused change with a clear description
• Ran format / lint / tests (see README)
• Updated docs or CHANGELOG if relevant
• Linked any related issue (e.g. Closes #123)

[github-actions]

Welcome, @kaminimangal, and thanks for your first pull request to VaultRAG.

A quick look at CONTRIBUTING.md covers how things are set up and run here.

I'll review this shortly. Ask anything in the thread if something is unclear.

[github-actions]

Merged, @kaminimangal. Thank you for taking the time.

Good, focused change. Exactly the kind of thing VaultRAG needs.

If VaultRAG is useful to you, a star goes a long way.

Happy to see more from you whenever you have the time.