Add masscan+nuclei mode, operator tuning controls, and vars file support to webrunner

- New scan mode: masscan+nuclei — masscan finds open ip:port pairs,
  nuclei runs operator-supplied CVE template against discovered hosts
- Per-country vulnerable host count in merge output via CIDR→country lookup
- Tuning args on every scan: --nmap-timing, --nmap-timeout, --nmap-workers,
  --nuclei-rate, --nuclei-concurrency, --nuclei-timeout, --masscan-rate
- Vars file support: operator provides scan_vars.yaml to pre-fill all
  tuning settings without interactive prompts
- Templates copied to nodes at provision time — no live fetches (OPSEC)
- run_scan.yml passes all tuning args with Ansible defaults as fallback
- configure_node.yml installs nuclei binary + uploads template on demand
- Updated deployment summary shows mode-specific tuning params
- countries-format.md and targets-format.md updated for new capabilities
- scan_vars.yaml.example documents all configurable settings with comments

modules/webrunner/inputs/targets-format.md

@@ -1,9 +1,45 @@
 # targets.yaml — Format Specification
 
 ## Purpose
-Defines what to look for during a scan. Each target is a fingerprint with
-one or more probes. The scanner runs masscan to find open ports, then fires
-each probe against matching hosts, and applies pattern/version matching.
+Defines what to look for during **geo-scout** mode scans. Each target is a
+fingerprint with one or more probes. The scanner runs masscan to find open
+ports, then fires each probe against matching hosts, and applies
+pattern/version matching.
+
+For **masscan+nuclei** mode, use a nuclei template instead (see below).
+targets.yaml is ignored in nuclei mode.
+
+## Nuclei template mode (masscan+nuclei)
+Provide a standard nuclei YAML template file. WEBRUNNER:
+1. Runs masscan to find open `ip:port` pairs
+2. Feeds those pairs as targets to nuclei with your template
+3. Outputs per-host match results + per-country vulnerable host counts
+
+**OPSEC note:** Templates are copied to nodes at provision time from your
+local path. No live template fetches happen during scans.
+
+**Template path:** Specify in `scan_vars.yaml` (`nuclei_template: /path/to/template.yaml`)
+or enter the path at the interactive prompt.
+
+### Minimal nuclei template structure
+```yaml
+id: cve-2024-example
+info:
+  name: Example CVE
+  severity: critical
+  tags: [cve, rce]
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/vulnerable/endpoint"
+    matchers:
+      - type: word
+        words:
+          - "vulnerable_string"
+```
+
+---
 
 ## Schema