Wire up on-demand deep-check: API route + dashboard button

POST /api/devices/:ip/deep-check runs deep-check-device.sh on the
CT122 host via SSH (reaches its own LAN IP), returns mDNS/SSDP/port
scan results. "Deep check" button on unknown device rows in the
dashboard shows results inline below the row.

Verified end-to-end via SSH before wiring into the API: correctly
identified Home Assistant via SSDP (friendlyName/manufacturer/model),
and confirmed both a shell-injection attempt and an out-of-subnet IP
get rejected cleanly by the forced command's input validation.

Closes #15 (all four pieces: OUI, mDNS, manual labels, deep check).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/config/index.ts

@@ -17,6 +17,12 @@ interface RawKnownDevice {
   name: string;
 }
 
+interface RawDeepCheck {
+  host: string;
+  port?: number;
+  username?: string;
+}
+
 export interface HostsConfig {
   proxmox: {
     host: string;
@@ -24,6 +30,7 @@ export interface HostsConfig {
   };
   sshHosts?: RawSshHost[];
   knownDevices?: RawKnownDevice[];
+  deepCheck?: RawDeepCheck;
 }
 
 export interface AppConfig {
@@ -47,9 +54,17 @@ export interface AppConfig {
   knownDevices: Map<string, string>;
   discoveryFilePath: string;
   oidc: OidcConfig | undefined;
+  deepCheck: DeepCheckHostConfig | undefined;
   hosts: HostsConfig;
 }
 
+export interface DeepCheckHostConfig {
+  host: string;
+  port: number;
+  username: string;
+  privateKeyPath: string;
+}
+
 export interface OidcConfig {
   issuerUrl: string;
   clientId: string;
@@ -113,6 +128,14 @@ export function loadConfig(hostsConfigPath: string): AppConfig {
     knownDevices: new Map((hosts.knownDevices ?? []).map((d) => [d.ip, d.name])),
     discoveryFilePath: process.env.DISCOVERY_FILE_PATH ?? "./data/devices-raw.json",
     oidc,
+    deepCheck: hosts.deepCheck
+      ? {
+          host: hosts.deepCheck.host,
+          port: hosts.deepCheck.port ?? 22,
+          username: hosts.deepCheck.username ?? "root",
+          privateKeyPath: sshPrivateKeyPath,
+        }
+      : undefined,
     hosts,
   };
 }