Add LAN device discovery (ping sweep + ARP, known/unknown labeling)

Runs as a host-level systemd timer on CT122 (scripts/discover-devices.sh)
rather than inside the api container, since real ARP entries live in the
host's network namespace, not Docker's bridge network. See
docs/device-discovery.md for the full writeup, including why literal
passive-only ARP reading was dropped (near-empty result in practice).

API reads the resulting JSON file each poll cycle, cross-references
config/hosts.yaml's knownDevices list by IP, and serves /api/devices.
Dashboard gets a new "Network Devices" table.

Closes #9.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -8,10 +8,14 @@ services:
       - HOSTS_CONFIG_PATH=/app/config/hosts.yaml
       - DB_PATH=/app/data/monitor.db
       - SSH_PRIVATE_KEY_PATH=/app/ssh/monitor_ed25519
+      - DISCOVERY_FILE_PATH=/app/data/devices-raw.json
     volumes:
       - ./config/hosts.yaml:/app/config/hosts.yaml:ro
       - ./ssh/monitor_ed25519:/app/ssh/monitor_ed25519:ro
-      - monitor-data:/app/data
+      # Bind mount (not a named volume) so scripts/discover-devices.sh, which
+      # runs on the host via systemd (see deploy/systemd/), can write
+      # devices-raw.json into the same place the container reads it from.
+      - ./data:/app/data
     networks:
       - web
 
@@ -28,6 +32,3 @@ services:
 
 networks:
   web:
-
-volumes:
-  monitor-data: