feat(scans): Run Nuclei Template scans only live DB hosts, no httpx

The global nuclei button now pulls liveOnly=true from the DB and targets each
host by its stored scheme-prefixed URL (https://host), so nuclei runs the
template directly with no httpx re-probing step. Errors clearly when there are
no live hosts yet. Modal copy + started log updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: h0tak88r

internal/api/ui/index.html

@@ -793,7 +793,7 @@ <h2 class="view-title" id="report-template-modal-title"> Edit Template</h2>
 <div id="nuclei-modal" class="auth-gate" style="display:none; z-index: 1000;" aria-modal="true" role="dialog">
   <div class="auth-card" style="max-width: 600px; width: 90%; max-height: 85vh; display: flex; flex-direction: column;">
     <h2 class="auth-title" style="margin-bottom: 8px;">Run Global Nuclei Scan</h2>
-    <p class="auth-sub" style="margin-bottom: 20px;">Enter a Nuclei template path/ID, OR paste raw YAML template code.</p>
+    <p class="auth-sub" style="margin-bottom: 20px;">Runs against <strong>all live hosts in the database</strong> (their stored <code>https://</code> URLs) — no httpx re-probing. Enter a Nuclei template path/ID, OR paste raw YAML template code.</p>
 
     <div style="display: flex; flex-direction: column; flex: 1; min-height: 0;">
       <textarea id="nuclei-template-input" class="search-input auth-input" 

internal/api/ui_api.go

@@ -671,19 +671,17 @@ func apiRunGlobalNuclei(c *gin.Context) {
 		limit := 10000
 		totalSubs := 0
 		for offset := 0; ; offset += limit {
-			subs, _, err := db.ListAllSubdomainsPaginated("", "", "", 0, false, limit, offset)
+			// liveOnly=true: only pull hosts already probed live via httpx. Each is
+			// written as its stored scheme-prefixed URL (https://host), so nuclei runs
+			// the template directly against it and never re-probes (no httpx step).
+			subs, _, err := db.ListAllSubdomainsPaginated("", "", "", 0, true, limit, offset)
 			if err != nil || len(subs) == 0 {
 				break
 			}
 			for _, s := range subs {
-				// For subdomains already probed live, use the stored scheme-prefixed
-				// URL (https://host) so nuclei skips its own httpx probing. Unprobed
-				// hosts fall back to the bare name (nuclei resolves the scheme itself).
-				target := s.Subdomain
-				if s.IsLive {
-					if u := s.BestURL(); u != "" {
-						target = u
-					}
+				target := s.BestURL()
+				if target == "" {
+					target = s.Subdomain
 				}
 				if target != "" {
 					tmpFile.WriteString(target + "\n")
@@ -694,10 +692,10 @@ func apiRunGlobalNuclei(c *gin.Context) {
 		tmpFile.Close()
 
 		if totalSubs == 0 {
-			return fmt.Errorf("no subdomains found for global nuclei scan")
+			return fmt.Errorf("no live hosts found in the database — run a scan/httpx first so there are live URLs to test")
 		}
 
-		stdLog(scanID, "[INFO] Loaded %d targets for scan", totalSubs)
+		stdLog(scanID, "[INFO] Loaded %d live host(s) from the database (httpx skipped)", totalSubs)
 
 		var templatePath string
 		var cleanupTemplate func()