Analytics: compare two finished runs

New page /analytics/compare and API GET /admin/analytics/compare (+ /lists/{group}):
the administrator picks an old (A) and a new (B) run; the report shows the new
addresses (only in B), the ones that left (only in A) and the common ones whose
membership in the seven indicators (pass, partial, fail, egress https any/all,
ingress ssh any/all) differs, with a "what changed" summary per address; the
dynamics of each indicator (delta = new - left + entered - exited) and a verdict
transition matrix. Every number opens a list with CSV. Cancelled addresses are not
part of a run. The list dialog moved to a shared analytics-dialog.js and template;
/analytics got a "compare with another run" button.

Docs, plan and summary in docs/changes/.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/dashboard/dashboard_test.go

@@ -44,9 +44,14 @@ type fakeControlAPI struct {
 
 	// Analytics: the run selector, the report JSON per run, the lists per
 	// "run/kind[/class]" and the subnet list of /settings.
-	runs          []analyticsRun
-	reports       map[int64]string
-	lists         map[string]string
+	runs    []analyticsRun
+	reports map[int64]string
+	lists   map[string]string
+	// compares is the comparison JSON per "base-target", compareLists the lists
+	// per "base-target/group[/indicator]".
+	compares     map[string]string
+	compareLists map[string]string
+
 	subnets       subnetList
 	analyticsReqs []string
 	// scanFreeAddresses is what POST /ips/scan "discovers" — tests set it
@@ -560,6 +565,41 @@ func (f *fakeControlAPI) handler() http.Handler {
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte(l))
 	})
+	mux.HandleFunc("GET /api/v1/admin/analytics/compare", func(w http.ResponseWriter, r *http.Request) {
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		f.analyticsReqs = append(f.analyticsReqs, r.URL.RequestURI())
+		rep, ok := f.compares[r.URL.Query().Get("base")+"-"+r.URL.Query().Get("target")]
+		if !ok {
+			writeAPIErr(w, http.StatusNotFound, "run not found")
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(rep))
+	})
+	mux.HandleFunc("GET /api/v1/admin/analytics/compare/lists/{group}", func(w http.ResponseWriter, r *http.Request) {
+		f.mu.Lock()
+		defer f.mu.Unlock()
+		f.analyticsReqs = append(f.analyticsReqs, r.URL.RequestURI())
+		q := r.URL.Query()
+		key := q.Get("base") + "-" + q.Get("target") + "/" + r.PathValue("group")
+		if ind := q.Get("indicator"); ind != "" {
+			key += "/" + ind
+		}
+		l, ok := f.compareLists[key]
+		if !ok {
+			writeAPIErr(w, http.StatusNotFound, "unknown list")
+			return
+		}
+		if q.Get("format") == "csv" {
+			w.Header().Set("Content-Type", "text/csv; charset=utf-8")
+			w.Header().Set("Content-Disposition", `attachment; filename="compare_`+r.PathValue("group")+`_run`+q.Get("base")+"-"+q.Get("target")+`.csv"`)
+			_, _ = w.Write([]byte("Адрес\r\n1.2.3.4\r\n"))
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(l))
+	})
 	mux.HandleFunc("GET /api/v1/admin/config/inbound-checks", func(w http.ResponseWriter, r *http.Request) {
 		f.mu.Lock()
 		defer f.mu.Unlock()