Add masscan+nuclei mode, operator tuning controls, and vars file support to webrunner

- New scan mode: masscan+nuclei — masscan finds open ip:port pairs,
  nuclei runs operator-supplied CVE template against discovered hosts
- Per-country vulnerable host count in merge output via CIDR→country lookup
- Tuning args on every scan: --nmap-timing, --nmap-timeout, --nmap-workers,
  --nuclei-rate, --nuclei-concurrency, --nuclei-timeout, --masscan-rate
- Vars file support: operator provides scan_vars.yaml to pre-fill all
  tuning settings without interactive prompts
- Templates copied to nodes at provision time — no live fetches (OPSEC)
- run_scan.yml passes all tuning args with Ansible defaults as fallback
- configure_node.yml installs nuclei binary + uploads template on demand
- Updated deployment summary shows mode-specific tuning params
- countries-format.md and targets-format.md updated for new capabilities
- scan_vars.yaml.example documents all configurable settings with comments

modules/webrunner/inputs/countries-format.md

@@ -1,9 +1,21 @@
 # countries.yaml — Format Specification
 
 ## Purpose
-Defines which countries to scan and scan parameters per country.
-This file is read by WEBRUNNER at runtime. The scanner resolves each
-country code to its CIDR ranges using RIR delegated stats files.
+Defines which countries to scan and optional per-country exclusions.
+Used by all WEBRUNNER scan modes. The scanner resolves each country code
+to its CIDR ranges using RIR delegated stats files (ARIN, RIPE, APNIC,
+LACNIC, AFRINIC — cached 24h locally).
+
+## Scope options
+- **Targeted countries**: list specific ISO codes in this file
+- **Single country**: just one entry
+- **Global sweep**: include every country you want — WEBRUNNER distributes
+  CIDRs across nodes automatically regardless of count
+
+## Relationship to scan_vars.yaml
+`scan_profile.rate` in this file sets the masscan default, but it is
+overridden by `masscan_rate` in `scan_vars.yaml` or the interactive tuning
+prompt. Prefer `scan_vars.yaml` for operator-level tuning.
 
 ## Schema
 

modules/webrunner/inputs/scan_vars.yaml.example

@@ -0,0 +1,31 @@
+# scan_vars.yaml — WEBRUNNER pre-configuration
+# Copy this file, fill in values, and provide the path at the "Vars file" prompt.
+# All fields are optional. Omit any field to be prompted interactively.
+
+# ── masscan ───────────────────────────────────────────────────────────────────
+masscan_rate: 5000          # packets/sec (default: mode-dependent, 3000–10000)
+                            # Lower for clients with strict IPS/rate-limiting
+
+# ── nmap (masscan+nmap and geo-scout modes) ───────────────────────────────────
+nmap_timing: 3              # T1=sneaky  T2=polite  T3=normal  T4=aggressive (default: 4)
+nmap_timeout: 120           # per-host timeout in seconds (default: 60)
+                            # Increase for slow/filtered networks
+nmap_workers: 10            # parallel nmap threads per node (default: 10)
+
+# ── nuclei (masscan+nuclei mode only) ─────────────────────────────────────────
+nuclei_template: "/path/to/your/cve-template.yaml"
+                            # Local path — copied to nodes at provision time
+                            # Never fetched from the internet during scans
+nuclei_rate: 150            # requests/sec rate limit (default: 150)
+                            # Lower for clients with WAF/rate-limiting
+nuclei_concurrency: 25      # concurrent goroutines (default: 25)
+nuclei_timeout: 10          # per-request timeout in seconds (default: 10)
+
+# ── example: conservative client profile ─────────────────────────────────────
+# masscan_rate: 1000
+# nmap_timing: 2
+# nmap_timeout: 180
+# nmap_workers: 5
+# nuclei_rate: 50
+# nuclei_concurrency: 10
+# nuclei_timeout: 20

modules/webrunner/inputs/targets-format.md

@@ -1,9 +1,45 @@
 # targets.yaml — Format Specification
 
 ## Purpose
-Defines what to look for during a scan. Each target is a fingerprint with
-one or more probes. The scanner runs masscan to find open ports, then fires
-each probe against matching hosts, and applies pattern/version matching.
+Defines what to look for during **geo-scout** mode scans. Each target is a
+fingerprint with one or more probes. The scanner runs masscan to find open
+ports, then fires each probe against matching hosts, and applies
+pattern/version matching.
+
+For **masscan+nuclei** mode, use a nuclei template instead (see below).
+targets.yaml is ignored in nuclei mode.
+
+## Nuclei template mode (masscan+nuclei)
+Provide a standard nuclei YAML template file. WEBRUNNER:
+1. Runs masscan to find open `ip:port` pairs
+2. Feeds those pairs as targets to nuclei with your template
+3. Outputs per-host match results + per-country vulnerable host counts
+
+**OPSEC note:** Templates are copied to nodes at provision time from your
+local path. No live template fetches happen during scans.
+
+**Template path:** Specify in `scan_vars.yaml` (`nuclei_template: /path/to/template.yaml`)
+or enter the path at the interactive prompt.
+
+### Minimal nuclei template structure
+```yaml
+id: cve-2024-example
+info:
+  name: Example CVE
+  severity: critical
+  tags: [cve, rce]
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/vulnerable/endpoint"
+    matchers:
+      - type: word
+        words:
+          - "vulnerable_string"
+```
+
+---
 
 ## Schema