feat(stats): filter scope counts by IATA and region

[n30nex]

What this PR does

/stats/scopes?iata=YVR currently returns global totals. Add iatas/iata, regionId and region filtering through the handler, Reader, Store, SQL and cache. Aggregate matching observations once for distinct packet/observer counts in each transport scope, separately from node IATA memberships, so overlapping regions do not inflate counts. Unfiltered totals and scope ordering remain unchanged.

Closes #95. A known empty region returns [], unknown/invalid regions return 400, and scopes with zero matching counts remain listed. The existing web chart explicitly requests global totals; connecting its region selector is a separate client follow-up.

Type of change

• New feature

Checklist

• go build ./... passes
• gofmt -l . is empty
• go vet ./... passes
• go test ./... passes
• Handler and cache regressions cover the new behavior
• SQL and mocks regenerated; no schema migration required
• Swagger annotations and generated docs/ updated
• No new dependencies
• Contribution rules followed; issue comment precedes implementation

Testing notes

The original endpoint fails the new invalid-region regression (200 instead of 400). Handler tests cover aliases, normalization, region ID/slug precedence, unions, empty regions and errors. Cache tests prove isolation and reuse across reordered/duplicate IATAs without mutating the caller's slice.

Native Pi PostgreSQL tests cover shared packets, several observers, cross-scope traffic, overlapping node memberships, global/empty filters and an empty roster. Local build/vet/tests and focused race checks pass. Both standalone and combined builds pass the full native Go suite with PostgreSQL enabled. GitHub Actions CI and CodeQL pass.

On a private Pi fixture with 20,000 packets, 80,000 observations and 20,000 nodes, final custom-plan queries took 0.2–25 ms; forced generic-plan queries took 22–55 ms. Unfiltered custom-plan execution was 16.6 ms versus 17.0 ms for the original query. These are synthetic measurements, not production timing claims.

The Canadaverse preview runs combined server 2a1db146 with the four previous server candidates and unchanged web b85bc19a. Source & changes offers matching source. Public parameter/error checks and both live feeds pass. The live preview has no configured transport scopes or regions, so positive filtered counts and region expansion are validated with isolated PostgreSQL fixtures and handler tests rather than claimed from live data.

AI assistance was used for implementation and verification under the author's ongoing contribution workflow.