Add LAN device discovery (ping sweep + ARP, known/unknown labeling)

Runs as a host-level systemd timer on CT122 (scripts/discover-devices.sh)
rather than inside the api container, since real ARP entries live in the
host's network namespace, not Docker's bridge network. See
docs/device-discovery.md for the full writeup, including why literal
passive-only ARP reading was dropped (near-empty result in practice).

API reads the resulting JSON file each poll cycle, cross-references
config/hosts.yaml's knownDevices list by IP, and serves /api/devices.
Dashboard gets a new "Network Devices" table.

Closes #9.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/discovery/index.ts

@@ -0,0 +1,36 @@
+import { readFile } from "node:fs/promises";
+import type Database from "better-sqlite3";
+import { upsertDevices, type DiscoveredDevice } from "../db/index.js";
+
+interface RawEntry {
+  ip: string;
+  mac: string;
+  state: string;
+}
+
+// Reads the JSON file produced by scripts/discover-devices.sh (a systemd timer
+// on the deploy host, not this process) and labels each entry against the
+// known-device list from config/hosts.yaml. See docs/device-discovery.md.
+export async function refreshDevices(
+  db: Database.Database,
+  filePath: string,
+  knownDevices: Map<string, string>
+): Promise<void> {
+  let raw: RawEntry[];
+  try {
+    raw = JSON.parse(await readFile(filePath, "utf8"));
+  } catch (err) {
+    // Missing file (timer hasn't run yet, or not deployed on this host) isn't
+    // fatal — just means no device data this cycle.
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw err;
+  }
+
+  const devices: DiscoveredDevice[] = raw.map((entry) => ({
+    ip: entry.ip,
+    mac: entry.mac,
+    knownName: knownDevices.get(entry.ip) ?? null,
+  }));
+
+  upsertDevices(db, devices);
+}