Add asynchronous full-site and URL-list accessibility audits

[AI-Vision-Aid]

Summary

• adds asynchronous whole-site crawling with AI-assisted selection limited to discovered same-site pages
• adds direct batch auditing from uploaded .txt or .docx URL lists, without crawling
• keeps full-site crawling as the default and enforces a 200-page maximum for both bulk modes
• reuses the saved/verified GPT-5.6 Sol setup, requester email, background processing, and detailed progress indicators
• generates consolidated HTML, CSV, JSON, and token/cost reports in the downloadable ZIP
• preserves the shared-password login gate and the existing single-page audit options

Validation

• 26 automated tests pass
• Python compilation succeeds
• inline browser JavaScript parses successfully
• secret scan and staged diff checks pass
• authenticated production browser verification confirms the default full-site mode, URL-list file selection, saved key masking/verification, selected GPT-5.6 Sol model, and mode-specific queue controls

Deployment note

Deployed to isolated Cloud Run service ability-bazaar-dat, revision ability-bazaar-dat-00010-l4p, with 100% of DAT traffic. The main Ability Bazaar service was not modified and remains on revision ability-bazaar-00087-gtr.

[reiganarmstrong]

Hi, I'm Reagan, a new student to C4G that will be contributing to this project! Here are the two concerns I had with this PR:

1. The dat_admin cookie is a deterministic hash of the shared password, and the server does not enforce an expiration time. Max-Age only tells the browser when to delete it, so a copied cookie remains valid until the password changes.
2. The /api/login endpoint also appears to allow unlimited password attempts, which leaves the shared password open to automated guessing.

Mitchell, Justin, and I were discussing integrating this project with the C4G Template. That project has has a more robust auth setup integrated into it and serve as a good solution to the problems I brought up + add a bunch of other good to have features on the authentication/authorization front. I was tasked with helping with that effort and I planned to start relatively soon.