feat: Add Data Flow Diagram support

[mrwadams]

Summary

• New Data Flow Diagram tab in the Streamlit web UI: generate DFDs from the application description or parse an uploaded DFD image (vision-capable models only), edit the Mermaid source live, preview it inline, and confirm with a checkbox to feed the diagram into subsequent Threat Model and Attack Tree runs as the authoritative system model.
• CLI /analyze agent now emits a system-level DFD after synthesis (architect tier, wrapped so a bad diagram never fails a good report). Rendered as a Mermaid block in the markdown report, carried in the JSON data_flow_diagram field, and shown in the HTML view via a CDN-loaded Mermaid runtime.
• Closes the description → DFD → review → refined threat model loop the issue describes.

Also fixes a latent NameError in the web UI: provider API keys were assigned function-local in load_env_variables() and never hoisted to module scope, so every existing tab (Threat Model, Attack Tree, Mitigations, DREAD, Test Cases, image analysis) would NameError on a fresh script run. Streamlit's hot-reload was masking this by leaking stale module locals. Now read from st.session_state into module scope once, after the sidebar has run.

Test plan

• uv run pytest -q — full suite green (304 tests; 16 new DFD tests)
• streamlit run apps/web/main.py — generate a DFD, edit the Mermaid, confirm, run Threat Model, verify threats reference DFD components (used CompassPay sample description during development)
• Upload a DFD image (PNG/JPEG) on a vision-capable provider — confirm the editor populates from the parse
• uv run stride-gpt analyze stride_gpt/agent --max-llm-calls 25 --yes — verify the markdown report contains ## Data Flow Diagram with a mermaid fenced block
• Same run with -f json — verify data_flow_diagram field is non-null
• Same run with -f html — open in browser, confirm the diagram renders

Closes #56