Registry and Analytics: run, subnet, direction and protocol filters, successes-by-target chart

Registry (/registry):
- filters by run (slice by the address's cycle in that run), subnet
  (drop-down of configured subnets), direction (egress/ingress) and
  protocol (icmp, tcp, ssh, https, tls); status in scope is computed over
  the narrowed checks
- chart "successful checks per target (egress) / site (ingress)" when both
  direction and protocol are chosen; a row opens the list of addresses
  (dialog, CSV)
- API: direction/protocol parameters and run in GET /admin/registry,
  GET /admin/registry/breakdown and /breakdown/list
- subnet filter passes ids as one JSON parameter (SQLite variable limit)

Analytics (/analytics):
- subnet filter recomputes the whole page over the addresses of the run
  inside the subnet; only their checks are read; cache per run and subnet
- direction and protocol focus the page; with both set the registry chart
  is shown
- subnet parameter in GET /admin/analytics/runs/{id} and lists (JSON, CSV)

Docs: plans and summaries in docs/changes, README, API, USAGE.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/httpapi/dto_admin.go

@@ -80,6 +80,28 @@ type registryPageResponse struct {
 	Total  int           `json:"total"`
 	Limit  int           `json:"limit"`
 	Offset int           `json:"offset"`
+	Run    int64         `json:"run"` // the run the results are read from, 0 = each address's newest cycle
+}
+
+// registryBreakdownDTO is GET /admin/registry/breakdown: the checks of one
+// direction and protocol per target (group "target", egress) or site (group
+// "site", ingress). Key is what ".../breakdown/list?key=" takes, Label the
+// name to show; Total counts checks, OK the successful ones. Run is 0 for each
+// address's newest cycle.
+type registryBreakdownDTO struct {
+	Group     string            `json:"group"`
+	Direction string            `json:"direction"`
+	Protocol  string            `json:"protocol"`
+	Run       int64             `json:"run"`
+	Addresses int               `json:"addresses"`
+	Rows      []breakdownRowDTO `json:"rows"`
+}
+
+type breakdownRowDTO struct {
+	Key   string `json:"key"`
+	Label string `json:"label"`
+	Total int    `json:"total"`
+	OK    int    `json:"ok"`
 }
 
 // registryDTO is one row of the durable per-address registry — see