feat: scope filter (host allow/deny, asset and analytics drop)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_scope.py

@@ -0,0 +1,40 @@
+from auto_reverse.models import CapturedFlow
+from auto_reverse.store import ScopeFilter
+
+
+def _flow(host: str, path: str, ctype: str = "application/json") -> CapturedFlow:
+    return CapturedFlow(
+        method="GET", host=host, path=path, query={}, req_headers={},
+        req_body=None, status=200, resp_headers={"content-type": ctype},
+        resp_body=b"{}", timestamp=0.0,
+    )
+
+
+def test_target_host_in_scope():
+    f = ScopeFilter(target_hosts={"app.example.com"})
+    assert f.is_in_scope(_flow("app.example.com", "/api/users"))
+
+
+def test_other_host_out_of_scope():
+    f = ScopeFilter(target_hosts={"app.example.com"})
+    assert not f.is_in_scope(_flow("cdn.other.com", "/x"))
+
+
+def test_static_asset_dropped():
+    f = ScopeFilter(target_hosts={"app.example.com"})
+    assert not f.is_in_scope(_flow("app.example.com", "/main.js", "application/javascript"))
+
+
+def test_analytics_host_dropped_by_default():
+    f = ScopeFilter(target_hosts={"app.example.com"})
+    assert not f.is_in_scope(_flow("www.google-analytics.com", "/collect"))
+
+
+def test_extra_allow_host():
+    f = ScopeFilter(target_hosts={"app.example.com"}, allow_hosts={"api.example.com"})
+    assert f.is_in_scope(_flow("api.example.com", "/v1/data"))
+
+
+def test_explicit_deny_overrides():
+    f = ScopeFilter(target_hosts={"app.example.com"}, deny_hosts={"app.example.com"})
+    assert not f.is_in_scope(_flow("app.example.com", "/api/users"))