Registry and Analytics: run, subnet, direction and protocol filters, successes-by-target chart

Registry (/registry):
- filters by run (slice by the address's cycle in that run), subnet
  (drop-down of configured subnets), direction (egress/ingress) and
  protocol (icmp, tcp, ssh, https, tls); status in scope is computed over
  the narrowed checks
- chart "successful checks per target (egress) / site (ingress)" when both
  direction and protocol are chosen; a row opens the list of addresses
  (dialog, CSV)
- API: direction/protocol parameters and run in GET /admin/registry,
  GET /admin/registry/breakdown and /breakdown/list
- subnet filter passes ids as one JSON parameter (SQLite variable limit)

Analytics (/analytics):
- subnet filter recomputes the whole page over the addresses of the run
  inside the subnet; only their checks are read; cache per run and subnet
- direction and protocol focus the page; with both set the registry chart
  is shown
- subnet parameter in GET /admin/analytics/runs/{id} and lists (JSON, CSV)

Docs: plans and summaries in docs/changes, README, API, USAGE.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/db/queries_runs_test.go

@@ -120,9 +120,17 @@ func TestRecheckAfterFinalizeOpensNewRun(t *testing.T) {
 	}
 	// The checks of a run are the ones of its result cycle, nothing else.
 	var got []RunCheck
-	if err := d.EachRunCheck(ctx, first.ID, func(c RunCheck) { got = append(got, c) }); err != nil || len(got) != 1 || !got[0].Success {
+	if err := d.EachRunCheck(ctx, first.ID, nil, func(c RunCheck) { got = append(got, c) }); err != nil || len(got) != 1 || !got[0].Success {
 		t.Fatalf("run 1 checks: %+v %v", got, err)
 	}
+	// With a list of addresses only theirs are read; an empty list reads none.
+	got = nil
+	if err := d.EachRunCheck(ctx, first.ID, []int64{}, func(c RunCheck) { got = append(got, c) }); err != nil || len(got) != 0 {
+		t.Fatalf("empty address list must read no checks: %+v %v", got, err)
+	}
+	if err := d.EachRunCheck(ctx, first.ID, []int64{old[0].RegistryID}, func(c RunCheck) { got = append(got, c) }); err != nil || len(got) != 1 {
+		t.Fatalf("listed address: %+v %v", got, err)
+	}
 }
 
 // A re-check while the run is still open joins it and replaces the address's