Registry and Analytics: run, subnet, direction and protocol filters, successes-by-target chart

Registry (/registry):
- filters by run (slice by the address's cycle in that run), subnet
  (drop-down of configured subnets), direction (egress/ingress) and
  protocol (icmp, tcp, ssh, https, tls); status in scope is computed over
  the narrowed checks
- chart "successful checks per target (egress) / site (ingress)" when both
  direction and protocol are chosen; a row opens the list of addresses
  (dialog, CSV)
- API: direction/protocol parameters and run in GET /admin/registry,
  GET /admin/registry/breakdown and /breakdown/list
- subnet filter passes ids as one JSON parameter (SQLite variable limit)

Analytics (/analytics):
- subnet filter recomputes the whole page over the addresses of the run
  inside the subnet; only their checks are read; cache per run and subnet
- direction and protocol focus the page; with both set the registry chart
  is shown
- subnet parameter in GET /admin/analytics/runs/{id} and lists (JSON, CSV)

Docs: plans and summaries in docs/changes, README, API, USAGE.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/dashboard/static/registry.js

@@ -0,0 +1,47 @@
+/* The chart of the registry ("registry_breakdown" in registry.html): a click on
+   a row opens the checks behind it in the analytics dialog (analytics-dialog.js).
+   The listener sits on the document, so it keeps working after htmx replaces the
+   table; the filter of the list is the one the chart was built with (data-qs). */
+(function () {
+  'use strict';
+  if (window.registryBreakdownBound) return;
+  window.registryBreakdownBound = true;
+
+  var HINTS = {
+    'Результат': 'Итог именно этой проверки. Список начинается с проваленных.',
+    'Тип проверки': 'https, icmp, ssh, tcp-22, tls-443 и т. д.',
+    'Валидатор': 'Валидатор, с которого шла egress-проверка.',
+    'Задержка, мс': 'Сколько заняла проверка.',
+    'Детали': 'Ошибка проверки, если она провалена.'
+  };
+
+  function open(btn) {
+    var A = window.AnalyticsDialog, box = btn.closest('#registry-breakdown');
+    if (!A || !box) return;
+    var tail = (box.dataset.qs ? box.dataset.qs + '&' : '') + 'key=' + encodeURIComponent(btn.dataset.bdKey);
+    var title = box.dataset.scope + ' · ' + btn.dataset.bdLabel;
+    A.load('/registry/breakdown/list?' + tail, title).then(function (l) {
+      if (!l) return;
+      var ok = l.rows.filter(function (r) { return r[1] === 'успешно'; }).length;
+      var hints = {};
+      l.columns.forEach(function (c, i) { if (HINTS[c]) hints[i] = HINTS[c]; });
+      A.fill({
+        title: title,
+        scope: 'Срез',
+        runLabel: box.dataset.slice,
+        note: 'Проверки этого типа в цикле адреса среза, у адресов под текущим фильтром. Провалы сверху.',
+        cols: l.columns, rows: l.rows, hints: hints,
+        dist: '<div class="an-chips"><span class="an-tag an-t-ok">успешно ' + A.fmt(ok) + '</span><span class="an-tag an-t-bad">провал ' + A.fmt(l.rows.length - ok) + '</span></div>',
+        csvURL: '/registry/breakdown/csv?' + tail
+      });
+      // the error text of a failed check is long: give its column room instead of a narrow wrapped strip
+      var d = l.columns.indexOf('Детали');
+      if (d >= 0) document.querySelectorAll('#an-dlg-tbl tr').forEach(function (tr) { if (tr.children[d]) tr.children[d].style.minWidth = '280px'; });
+    });
+  }
+
+  document.addEventListener('click', function (e) {
+    var b = e.target.closest('[data-bd-key]');
+    if (b) open(b);
+  });
+})();