Add the Analytics section: check runs, analytics API and page

Runs (migration 0011): a run groups the cycles of one launch. It opens when an
address enters an idle queue, takes everything submitted or re-checked while it
is open and is finalized when all its addresses are done; a re-check after that
opens a new run, so results of different runs never mix. check_runs,
run_results (one result per address and run, with the verdict and the expected
and stored check counts), subnets, run_id on ip_queue and checks. Existing data
is split into runs at pauses of more than an hour; ingress checks get the
validator that held the address (also at write time from now on).

Analytics (internal/analytics): figures computed from the stored checks of the
latest cycle of each address in the run, as facts next to the verdict: summary,
reasons of partial, data quality, subnets, targets and the subnet x target
matrix by check type, ingress by site, error classes, validators, and the
address lists behind the indicators and error classes. API: analytics runs,
report, lists (JSON or CSV), subnet list; run and subnet filters for the
registry.

Dashboard: /analytics matching the approved mockup (run selector, indicators
with address lists and CSV, error-class dialogs, drill-down to the registry),
subnet list on /settings. Sidebar: the control-api link state, theme toggle and
logout moved to the top, the three dots next to the logo removed, sections
grouped.

Rebuilt bin/control-api and bin/admin-dashboard to match. Plan, summary and the
updated README, API, USAGE, DASHBOARD and ADMIN_CLEANUP docs are in docs/.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/db/queries_registry.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
+	"net/netip"
 	"sort"
 	"strings"
 	"time"
@@ -120,6 +121,34 @@ func (d *DB) ListRegistry(ctx context.Context) ([]RegistrySummary, error) {
 type RegistryFilter struct {
 	Query      string // substring of ip_address
 	LastResult string // pass|partial|fail|cancelled — same meaning as RegistrySummary.LastResult
+	RunID      int64  // only addresses that have a result in this run
+	Subnet     string // only addresses inside this CIDR
+}
+
+// subnetIDs returns the registry ids of the addresses inside prefix. SQLite
+// has no CIDR operators, so the registry's addresses are filtered here.
+func (d *DB) subnetIDs(ctx context.Context, cidr string) ([]any, error) {
+	p, err := netip.ParsePrefix(cidr)
+	if err != nil {
+		return nil, fmt.Errorf("subnet %q: %v: %w", cidr, err, ErrValidation)
+	}
+	rows, err := d.QueryContext(ctx, `SELECT id, ip_address FROM ip_registry`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var ids []any
+	for rows.Next() {
+		var id int64
+		var ip string
+		if err := rows.Scan(&id, &ip); err != nil {
+			return nil, err
+		}
+		if a, err := netip.ParseAddr(ip); err == nil && p.Contains(a) {
+			ids = append(ids, id)
+		}
+	}
+	return ids, rows.Err()
 }
 
 // lastResultCond is the SQL form of fillRegistrySummary's LastResult rule,
@@ -155,6 +184,22 @@ func (d *DB) ListRegistryPage(ctx context.Context, f RegistryFilter, limit, offs
 		conds = append(conds, lastResultCond)
 		args = append(args, f.LastResult, f.LastResult)
 	}
+	if f.RunID > 0 {
+		conds = append(conds, "r.id IN (SELECT registry_id FROM run_results WHERE run_id = ?)")
+		args = append(args, f.RunID)
+	}
+	if f.Subnet != "" {
+		ids, err := d.subnetIDs(ctx, f.Subnet)
+		if err != nil {
+			return nil, 0, err
+		}
+		if len(ids) == 0 {
+			conds = append(conds, "0 = 1")
+		} else {
+			conds = append(conds, "r.id IN ("+strings.TrimSuffix(strings.Repeat("?,", len(ids)), ",")+")")
+			args = append(args, ids...)
+		}
+	}
 	from := ` FROM ip_registry r LEFT JOIN ip_queue q ON q.registry_id = r.id `
 	where := ""
 	if len(conds) > 0 {