feat: wire the analysis pipeline into the web wizard & POST /api/analyze

[Liohtml]

Summary

Follow-up to #134 (docs fix). POST /api/analyze currently returns 501; the browser wizard cannot run an analysis. This issue tracks actually implementing the web analysis path.

Scope

• Connect the validated AnalyzeRequest to WorkflowEngine, the same way the CLI (main.py) builds and runs the pipeline
• Respect the existing guards: allow_cloud_llm consent, API key, rate limiting, CSRF origin check
• Blocker: resolve [repo-health] Medium: LocalProvider.fetch() accepts arbitrary filesystem paths — path traversal risk when /api/analyze is wired up #61 first — LocalProvider.fetch() must be sandboxed to a configured base directory before a network-reachable endpoint may pass it arbitrary source paths
• Decide the execution model (synchronous request vs. background job + polling) — analyses can take minutes with local ML or LLM calls
• Return a structured result (report path / findings JSON) instead of the current 501 detail
• Update README/quickstart/UI to remove the preview notices added by [repo-health] High: README/Quickstart advertise the web wizard & POST /api/analyze, but the endpoint is a hardcoded 501 stub #134's docs fix

References

• Stub: src/medcheck/web/app.py (analyze() endpoint)
• CLI pipeline construction: src/medcheck/main.py
• Path sandboxing prerequisite: [repo-health] Medium: LocalProvider.fetch() accepts arbitrary filesystem paths — path traversal risk when /api/analyze is wired up #61

---

Follow-up from repo health check (2026-07-10)