Add the Analytics section: check runs, analytics API and page

Runs (migration 0011): a run groups the cycles of one launch. It opens when an
address enters an idle queue, takes everything submitted or re-checked while it
is open and is finalized when all its addresses are done; a re-check after that
opens a new run, so results of different runs never mix. check_runs,
run_results (one result per address and run, with the verdict and the expected
and stored check counts), subnets, run_id on ip_queue and checks. Existing data
is split into runs at pauses of more than an hour; ingress checks get the
validator that held the address (also at write time from now on).

Analytics (internal/analytics): figures computed from the stored checks of the
latest cycle of each address in the run, as facts next to the verdict: summary,
reasons of partial, data quality, subnets, targets and the subnet x target
matrix by check type, ingress by site, error classes, validators, and the
address lists behind the indicators and error classes. API: analytics runs,
report, lists (JSON or CSV), subnet list; run and subnet filters for the
registry.

Dashboard: /analytics matching the approved mockup (run selector, indicators
with address lists and CSV, error-class dialogs, drill-down to the registry),
subnet list on /settings. Sidebar: the control-api link state, theme toggle and
logout moved to the top, the three dots next to the logo removed, sections
grouped.

Rebuilt bin/control-api and bin/admin-dashboard to match. Plan, summary and the
updated README, API, USAGE, DASHBOARD and ADMIN_CLEANUP docs are in docs/.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/dashboard/client.go

@@ -244,6 +244,8 @@ func (c *client) ScanStatus(ctx context.Context) (scanStatusDTO, error) {
 type registryQuery struct {
 	Q          string
 	LastResult string
+	Run        int64  // only addresses with a result in this run
+	Subnet     string // only addresses inside this CIDR
 	Limit      int
 	Offset     int
 }
@@ -264,6 +266,12 @@ func (c *client) ListRegistryPage(ctx context.Context, q registryQuery) (registr
 	if q.LastResult != "" {
 		v.Set("last_result", q.LastResult)
 	}
+	if q.Run > 0 {
+		v.Set("run", strconv.FormatInt(q.Run, 10))
+	}
+	if q.Subnet != "" {
+		v.Set("subnet", q.Subnet)
+	}
 	var out registryPage
 	err := c.do(ctx, http.MethodGet, "/api/v1/admin/registry?"+v.Encode(), nil, &out)
 	return out, err
@@ -392,3 +400,104 @@ func (c *client) StopAutoCycle(ctx context.Context) (autoCycleDTO, error) {
 	err := c.do(ctx, http.MethodPost, "/api/v1/admin/auto-cycle/stop", nil, &out)
 	return out, err
 }
+
+// analyticsRun is one entry of GET /admin/analytics/runs (the run selector).
+type analyticsRun struct {
+	ID          int64      `json:"id"`
+	Kind        string     `json:"kind"`
+	State       string     `json:"state"`
+	StartedAt   time.Time  `json:"started_at"`
+	FinalizedAt *time.Time `json:"finalized_at"`
+	Addresses   int        `json:"addresses"`
+	Pass        int        `json:"pass"`
+	Partial     int        `json:"partial"`
+	Fail        int        `json:"fail"`
+	Cancelled   int        `json:"cancelled"`
+	Total       int        `json:"total"`
+	Pending     int        `json:"pending"`
+}
+
+func (c *client) ListAnalyticsRuns(ctx context.Context) ([]analyticsRun, error) {
+	var out []analyticsRun
+	err := c.do(ctx, http.MethodGet, "/api/v1/admin/analytics/runs", nil, &out)
+	return out, err
+}
+
+// GetAnalyticsReport returns the analytics of one finished run as the raw
+// JSON control-api computed; the page's script reads it as it is.
+func (c *client) GetAnalyticsReport(ctx context.Context, runID int64) (json.RawMessage, error) {
+	var out json.RawMessage
+	err := c.do(ctx, http.MethodGet, "/api/v1/admin/analytics/runs/"+strconv.FormatInt(runID, 10), nil, &out)
+	return out, err
+}
+
+func analyticsListPath(runID int64, kind, class string, csv bool) string {
+	v := url.Values{}
+	if class != "" {
+		v.Set("class", class)
+	}
+	if csv {
+		v.Set("format", "csv")
+	}
+	p := "/api/v1/admin/analytics/runs/" + strconv.FormatInt(runID, 10) + "/lists/" + url.PathEscape(kind)
+	if len(v) > 0 {
+		p += "?" + v.Encode()
+	}
+	return p
+}
+
+// GetAnalyticsList returns one address table (JSON) of a run.
+func (c *client) GetAnalyticsList(ctx context.Context, runID int64, kind, class string) (json.RawMessage, error) {
+	var out json.RawMessage
+	err := c.do(ctx, http.MethodGet, analyticsListPath(runID, kind, class, false), nil, &out)
+	return out, err
+}
+
+// GetAnalyticsListCSV returns the CSV file of one address table, with the
+// file name control-api proposed.
+func (c *client) GetAnalyticsListCSV(ctx context.Context, runID int64, kind, class string) ([]byte, string, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+analyticsListPath(runID, kind, class, true), nil)
+	if err != nil {
+		return nil, "", fmt.Errorf("build request: %w", err)
+	}
+	if c.token != "" {
+		req.Header.Set("Authorization", "Bearer "+c.token)
+	}
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return nil, "", &apiErr{Status: 0, Message: err.Error()}
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode >= 300 {
+		msg := string(body)
+		var er errorResponse
+		if json.Unmarshal(body, &er) == nil && er.Error != "" {
+			msg = er.Error
+		}
+		return nil, "", &apiErr{Status: resp.StatusCode, Message: msg}
+	}
+	return body, resp.Header.Get("Content-Disposition"), nil
+}
+
+// subnetEntry is one line of the subnet list (GET/PUT /admin/config/subnets).
+type subnetEntry struct {
+	CIDR  string `json:"cidr"`
+	Label string `json:"label,omitempty"`
+}
+
+type subnetList struct {
+	Subnets []subnetEntry `json:"subnets"`
+}
+
+func (c *client) GetSubnets(ctx context.Context) (subnetList, error) {
+	var out subnetList
+	err := c.do(ctx, http.MethodGet, "/api/v1/admin/config/subnets", nil, &out)
+	return out, err
+}
+
+func (c *client) PutSubnets(ctx context.Context, in subnetList) (subnetList, error) {
+	var out subnetList
+	err := c.do(ctx, http.MethodPut, "/api/v1/admin/config/subnets", in, &out)
+	return out, err
+}