feat: add localhost web UI for scans, blocklist, and firewall management

app.py

@@ -1,18 +1,55 @@
 #!/usr/bin/env python3
 """Intrusion Detection System — unified entry point.
 
-Runs both copyparty and NPM log analyzers, consolidates blocklist
-candidates, and optionally synchronizes the MikroTik RouterOS firewall.
+By default this starts the localhost-only Flask web UI. Pass ``scan`` to
+run the consolidated CLI scan instead.
 
 Usage:
-    python app.py --quiet
-    python app.py --update-firewall --dry-run
-    python app.py --update-firewall
+    python app.py                          # start the web UI (default)
+    python app.py --web-port 54666         # web UI with a custom port
+    python app.py scan [options]           # run the consolidated CLI scan
 """
 
 from __future__ import annotations
 
-from app.scan import main
+import argparse
+import sys
+
+from app.constants import WEB_HOST, WEB_PORT
+
+
+def _web_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="app.py",
+        description="Intrusion Detection System: web UI (default) or 'scan' subcommand.",
+    )
+    parser.add_argument("--web-host", default=WEB_HOST,
+                        help=f"web UI bind host (default: {WEB_HOST})")
+    parser.add_argument("--web-port", type=int, default=WEB_PORT,
+                        help=f"web UI port (default: {WEB_PORT})")
+    return parser
+
+
+def _run_web(host: str, port: int) -> None:
+    from app.web import serve
+    serve(host=host, port=port)
+
+
+def _run_scan(argv: list[str]) -> None:
+    from app.scan import main as scan_main
+    scan_main(argv)
+
+
+def main() -> None:
+    # `python app.py scan ...` runs the consolidated CLI scan.
+    if len(sys.argv) > 1 and sys.argv[1] == "scan":
+        _run_scan(sys.argv[2:])
+        return
+
+    # Default: start the web UI (parse_known_args tolerates stray flags).
+    args, _ = _web_parser().parse_known_args()
+    _run_web(args.web_host, args.web_port)
+
 
 if __name__ == "__main__":
     main()