Analytics: compare two finished runs

New page /analytics/compare and API GET /admin/analytics/compare (+ /lists/{group}):
the administrator picks an old (A) and a new (B) run; the report shows the new
addresses (only in B), the ones that left (only in A) and the common ones whose
membership in the seven indicators (pass, partial, fail, egress https any/all,
ingress ssh any/all) differs, with a "what changed" summary per address; the
dynamics of each indicator (delta = new - left + entered - exited) and a verdict
transition matrix. Every number opens a list with CSV. Cancelled addresses are not
part of a run. The list dialog moved to a shared analytics-dialog.js and template;
/analytics got a "compare with another run" button.

Docs, plan and summary in docs/changes/.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/httpapi/routes.go

@@ -68,6 +68,8 @@ func (s *Server) routeTable() []route {
 		{"GET /api/v1/admin/analytics/runs", s.handleAnalyticsRuns, accessAdmin},
 		{"GET /api/v1/admin/analytics/runs/{id}", s.handleAnalyticsRun, accessAdmin},
 		{"GET /api/v1/admin/analytics/runs/{id}/lists/{kind}", s.handleAnalyticsList, accessAdmin},
+		{"GET /api/v1/admin/analytics/compare", s.handleAnalyticsCompare, accessAdmin},
+		{"GET /api/v1/admin/analytics/compare/lists/{group}", s.handleAnalyticsCompareList, accessAdmin},
 		{"GET /api/v1/admin/config/subnets", s.handleConfigGetSubnets, accessAdmin},
 		{"PUT /api/v1/admin/config/subnets", s.handleConfigPutSubnets, accessAdmin},
 		{"GET /api/v1/admin/config/validators", s.handleConfigListValidators, accessAdmin},