Add optional local web UI: upload domains, download reports, diff runs (#23)

[CallMarcus]

Implements the MVP scope of #23 — a thin, optional Flask web layer over the existing analysis engine, so a list of domains can be analyzed from the browser without touching the command line. Core analysis logic is untouched; the package stays fully usable without the web extra.

What you get

Install the extra and launch:

pip install "domain-security-analyzer[web]"
domain-analyzer-web --open      # serves http://127.0.0.1:8000

The UI lets you:

• Upload domains by pasting (one per line, # comments ignored) or dropping a .txt file.
• Watch progress — analysis runs in a background thread with a live progress bar (the page polls a small JSON status endpoint and stays responsive).
• Download the standard 29-column CSV for any run.
• View changes — each run is saved locally; the Changes page diffs the two most recent runs and classifies per-domain deltas into security regressions (SPF/DMARC lost, SRI coverage dropped, HTTPS redirect lost…) vs. improvements, plus domains added/removed.

Binds to 127.0.0.1 only; runs are stored under ~/.domain-security-analyzer/runs/ (override via DSA_DATA_DIR). Single-user local tool by design.

Changes

New domain_security_analyzer/web/ subpackage

• app.py — Flask app factory, in-memory job registry, routes (/, /run, /run/<id>, /run/<id>/status, /results/<run>, /download/<run>, /changes). Download path is validated against traversal.
• runs.py — timestamped-CSV storage + the run-diff classifier.
• cli.py / __main__.py — the domain-analyzer-web launcher (--host/--port/--open/--debug), with a clear message if the web extra isn't installed.
• templates/ + static/style.css — minimal dark UI.

Engine refactor in analyzer.py (backward compatible)

• Extracted the inline CSV writing into a reusable write_results_csv() helper + a shared CSV_COLUMNS constant.
• Added an optional progress_callback(completed, total) to analyze_domains_from_file so the UI gets real progress without scraping stdout. Existing callers/behavior unchanged.

Packaging / CI

• New [web] extra (flask>=3.0; also added to [dev]); domain-analyzer-web entry point; web templates/static packaged in both wheel and sdist (verified).
• CI installs .[web] and smoke-tests domain-analyzer-web --help.

Verification

• 45 tests pass (8 new in tests/test_web.py, all network-free — domain parsing, run-diff classification incl. timestamp-ignore, and the full run → progress → results → download flow with the engine monkeypatched, plus path-traversal rejection).
• python -m build + twine check → PASSED on wheel and sdist.
• Live server smoke-tested: /, /changes, and /static/style.css all 200.
• Both domain-analyzer-web and python -m domain_security_analyzer.web launch.

Out of scope (stays on #23)

Full cross-run history / trend charts / SQLite — this MVP diffs the last two runs only, as agreed.

🤖 Generated with Claude Code

---

Generated by Claude Code