feat: add 'python app.py analyze' CLI report (L002)

Reads the persisted SQLite store to print a detailed analysis: latest scans,
top IPs, cross-source IPs, active blocklist ledger, and a per-IP request
history drill-down (--ip). Supports --since, --top, --json. No scan is run.

app.py

@@ -40,12 +40,22 @@ def _run_scan(argv: list[str]) -> None:
     scan_main(argv)
 
 
+def _run_analyze(argv: list[str]) -> None:
+    from app.analyze import main as analyze_main
+    analyze_main(argv)
+
+
 def main() -> None:
     # `python app.py scan ...` runs the consolidated CLI scan.
     if len(sys.argv) > 1 and sys.argv[1] == "scan":
         _run_scan(sys.argv[2:])
         return
 
+    # `python app.py analyze ...` prints a detailed report from the SQLite store.
+    if len(sys.argv) > 1 and sys.argv[1] == "analyze":
+        _run_analyze(sys.argv[2:])
+        return
+
     # Default: start the web UI (parse_known_args tolerates stray flags).
     args, _ = _web_parser().parse_known_args()
     _run_web(args.web_host, args.web_port)