A $37 GLM 5.3 red team: the Alloy-modeled auth layer held, but two bugs outside