docs: add Juice Shop --fix evidence snapshot

Author: sonukapoor

assets/owasp-juice-shop-auto-fix.png

@@ -49,6 +49,44 @@ Terminal snapshots from this run:
 
 ![Juice Shop dependency path hints and remaining risk](https://raw.githubusercontent.com/sonukapoor/cve-lite-cli/main/assets/owasp-juice-shop-5.png)
 
+## Auto-fix pass (`--fix`) evidence
+
+After the planning scan, we ran a focused auto-fix pass:
+
+```bash
+npx cve-lite-cli . --fix
+```
+
+Run outcome:
+
+- applied direct package fixes: `7`
+- skipped findings: `5`
+  - transitive (v1 skip): `3`
+  - no validated direct target: `2`
+- findings before fix: `39`
+- findings after fix pass: `39`
+- remaining severity mix: critical `3`, high `1`, medium `11`, low `23`, unknown `1`
+
+Applied direct dependency upgrades:
+
+- `jsonwebtoken: 0.1.0 -> 9.0.0`
+- `sanitize-html: 1.4.2 -> 2.12.1`
+- `multer: 1.4.5-lts.2 -> 2.1.1`
+- `express-jwt: 0.1.3 -> 6.0.0`
+- `file-type: 16.5.4 -> 21.3.1`
+- `js-yaml: 4.0.0 -> 4.1.1`
+- `socket.io: 3.1.2 -> 4.6.2`
+
+Why the total finding count can remain unchanged after auto-fix:
+
+- a large share of Juice Shop findings are transitive and still require parent-chain upgrades
+- some direct findings have no validated auto-apply target
+- duplicate vulnerable packages can still exist in other dependency paths until parent upgrades are applied
+
+Auto-fix terminal snapshot:
+
+![Juice Shop auto-fix summary output](https://raw.githubusercontent.com/sonukapoor/cve-lite-cli/main/assets/owasp-juice-shop-auto-fix.png)
+
 ## Copy-and-run remediation output
 
 In this run, CVE Lite CLI generated `6` command groups across `10` packages: