Analytics: make the pass, partial and fail indicators clickable

The three verdict cards on /analytics now open the same dialog as the https/ssh
cards, with the addresses of the run that got this verdict (CSV and copy
included). New list kinds verdict_pass, verdict_partial and verdict_fail in
GET /admin/analytics/runs/{id}/lists/{kind}: address, subnet, validator,
egress and ingress "ok of all", checks stored of expected; partial adds the
reason, the same names as the "Why partial" block. Cancelled addresses are not
listed; the row count equals summary.pass/partial/fail. The fail card stays
inert at zero. addr.incomplete() is shared by the list and the report.

Docs, plan and summary in docs/changes/.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/httpapi/handlers_analytics.go

@@ -133,7 +133,8 @@ func (s *Server) handleAnalyticsRun(w http.ResponseWriter, r *http.Request) {
 var nonSlug = regexp.MustCompile(`[^a-z0-9]+`)
 
 // handleAnalyticsList serves the address table behind one indicator
-// (kind = egress_https_any|egress_https_all|ingress_ssh_any|ingress_ssh_all)
+// (kind = egress_https_any|egress_https_all|ingress_ssh_any|ingress_ssh_all),
+// the addresses of one verdict (kind = verdict_pass|verdict_partial|verdict_fail)
 // or one ingress error class (kind = error, ?class=...), as JSON or, with
 // ?format=csv, as a downloadable CSV file.
 func (s *Server) handleAnalyticsList(w http.ResponseWriter, r *http.Request) {