FEAT: Add saved attack results analytics GUI

[Roman Lutz (romanlutz)]

Description

Users need to explore saved attack results without exporting data or interpreting a paginated sample as the whole population. This completes part 5 of the attack analytics roadmap, building on the REST/SDK foundation merged in #3149.

• Adds Analytics navigation, cohort filters, outcome-composition and success-rate bars, a two-axis heatmap with an accessible cell-data view, SDK-provided drilldowns, and a matching-results table with keyboard-accessible rows.
• Keeps all numerical aggregation, cohort selection, overlap, target keys, and drilldown restrictions in the SDK. Every saved AttackResult ID remains part of the population, including shared conversations and scenario retries. Explicit counts distinguish decided-result ASR from the all-result rate; unavailable rates are not shown as zero.
• Uses the shared API client and runtime readiness/compatibility paths. Manual Reload replaces polling; result pagination does not refresh report statistics. Cancellation, runtime-generation changes, retry cooldowns, and cursor recovery preserve cohort and freshness boundaries.
• Stores shared filter state in the URL fragment to avoid the existing server request-target limit without dropping filters. Valid legacy query links migrate; malformed state requires explicit recovery rather than silently broadening the cohort. Time bounds require an explicit offset and retain UTC instant semantics.
• Consolidates SDK-fed outcome presentation with exact green/red/blue/gray fills across light and dark themes. Adapts presentation relevant to the still-open FEAT: outcome breakdown visualization on the scenario run page #2644 without importing client-side row aggregation or merging that branch.

Critical self-review fixes include stale request/page revival during A -> B -> A navigation, rejected-edit errors after Back, invalid link acceptance, abortable Retry-After cooldowns, and narrow-layout overflow. Backend arithmetic, storage configuration, HTTP endpoints, and performance-test policies are unchanged. Started from ca54989f8049a693dd6af311fe656b5a9656e5fd.

Tests and Documentation

Added component, hook, API-client, URL/date, and request-lifecycle regressions. A dedicated browser suite uses the real application routes and compatibility/readiness middleware over isolated synthetic SQLite, with a private home/config and no shared database or external provider calls. It covers saved-ID counting, scenario retries, pagination, large direct/reload/Back links, invalid-state recovery, exact outcome fills, keyboard navigation, and narrow layouts. The suite is an additional shard of the existing required frontend E2E CI check.

Validation completed before PR creation:

• npm --prefix frontend run test:coverage -- --maxWorkers=2 --silent --coverageReporters=text-summary --coverageReporters=json-summary: passed, 120 suites and 2,981 tests; all coverage thresholds passed.
• npm --prefix frontend run test:e2e:analytics: passed, 9 real-SQLite browser tests.
• npx tsc --project tsconfig.test.json --noEmit from frontend: passed.
• npm --prefix frontend run build: passed, including a clean committed-head build with matching frontend/backend compatibility stamps.

ESLint, main TypeScript checking, Ruff check/format, commit pre-commit checks, and a focused analytics-hook open-handle check also passed. Final light/dark, heatmap-drilldown, and narrow screenshots were captured and inspected locally after fixes; images are retained in session artifacts and not uploaded or committed.

Known validation limits: live Azure SQL, Entra-authenticated deployment, and external providers were not exercised. The full Jest run passed but emitted a worker-force-exit warning; focused analytics hooks reported no open handles, so the cause remains unestablished. Vite emitted config-loader and large-chunk warnings. The backend 100,000-result workload was not repeated for this frontend-only slice. JupyText was not run because no executable documentation examples changed.

Updated the GUI guide and frontend README with analytics semantics, sharing, dates, refresh behavior, and the isolated browser-test setup.