feat: embedded draw.io diagram editor for threat modelling

[Mavi9412]

Summary

• Integrates the official diagrams.net embed editor directly into the Threat Model tab as an optional alternative to image upload
• Diagram XML is parsed with stdlib xml.etree.ElementTree to extract components, data flows, and trust boundaries — this structured context is injected into the LLM prompt, producing richer threat models than image analysis alone
• App description text area auto-fills from the saved diagram (mirrors existing PNG upload behaviour)
• Existing image upload workflow is completely unchanged

New files

File	Purpose
stride_gpt/core/drawio_parser.py	draw.io XML parser — extracts components, connections, trust boundaries. Includes __main__ self-test. No new dependencies (stdlib only).
apps/web/components/drawio_editor/__init__.py	Streamlit declare_component wrapper returning {action, xml}
apps/web/components/drawio_editor/frontend/index.html	Pure HTML/JS embedding embed.diagrams.net via the official proto=json postMessage API. No npm build step required.

Changed files

File	Change
apps/web/main.py	Editor toggle button in col1 alongside image upload; full-width editor renders above the input columns; XML context injected at prompt-build time
README.md	Feature entry added to the features list

How it works

User draws diagram in editor
        ↓
Save & Close → draw.io postMessage → XML returned to Python
        ↓
stride_gpt/core/drawio_parser.py extracts:
  • Components (User, Web App, Database …)
  • Data Flows (User → Web App (HTTPS) …)
  • Trust Boundaries (Internal Network …)
        ↓
Structured text prepended to LLM prompt
        ↓
Higher-quality, diagram-aware threat model

Test plan

• Click Open Diagram Editor — editor opens full-width above the form, no loading error
• Draw shapes and arrows, click Save & Close — app description text area auto-fills with extracted architecture
• Click Generate Threat Model — threats reference the diagram components by name
• Click Clear diagram — text area clears, next generation uses only manual input
• Upload a PNG as before — existing flow unaffected
• Run python stride_gpt/core/drawio_parser.py — all assertions pass

[Mavi9412]