Add masscan+nuclei mode, operator tuning controls, and vars file support to webrunner

- New scan mode: masscan+nuclei — masscan finds open ip:port pairs,
  nuclei runs operator-supplied CVE template against discovered hosts
- Per-country vulnerable host count in merge output via CIDR→country lookup
- Tuning args on every scan: --nmap-timing, --nmap-timeout, --nmap-workers,
  --nuclei-rate, --nuclei-concurrency, --nuclei-timeout, --masscan-rate
- Vars file support: operator provides scan_vars.yaml to pre-fill all
  tuning settings without interactive prompts
- Templates copied to nodes at provision time — no live fetches (OPSEC)
- run_scan.yml passes all tuning args with Ansible defaults as fallback
- configure_node.yml installs nuclei binary + uploads template on demand
- Updated deployment summary shows mode-specific tuning params
- countries-format.md and targets-format.md updated for new capabilities
- scan_vars.yaml.example documents all configurable settings with comments

modules/webrunner/inputs/countries-format.md

@@ -1,9 +1,21 @@
 # countries.yaml — Format Specification
 
 ## Purpose
-Defines which countries to scan and scan parameters per country.
-This file is read by WEBRUNNER at runtime. The scanner resolves each
-country code to its CIDR ranges using RIR delegated stats files.
+Defines which countries to scan and optional per-country exclusions.
+Used by all WEBRUNNER scan modes. The scanner resolves each country code
+to its CIDR ranges using RIR delegated stats files (ARIN, RIPE, APNIC,
+LACNIC, AFRINIC — cached 24h locally).
+
+## Scope options
+- **Targeted countries**: list specific ISO codes in this file
+- **Single country**: just one entry
+- **Global sweep**: include every country you want — WEBRUNNER distributes
+  CIDRs across nodes automatically regardless of count
+
+## Relationship to scan_vars.yaml
+`scan_profile.rate` in this file sets the masscan default, but it is
+overridden by `masscan_rate` in `scan_vars.yaml` or the interactive tuning
+prompt. Prefer `scan_vars.yaml` for operator-level tuning.
 
 ## Schema