Wire up on-demand deep-check: API route + dashboard button

POST /api/devices/:ip/deep-check runs deep-check-device.sh on the
CT122 host via SSH (reaches its own LAN IP), returns mDNS/SSDP/port
scan results. "Deep check" button on unknown device rows in the
dashboard shows results inline below the row.

Verified end-to-end via SSH before wiring into the API: correctly
identified Home Assistant via SSDP (friendlyName/manufacturer/model),
and confirmed both a shell-injection attempt and an out-of-subnet IP
get rejected cleanly by the forced command's input validation.

Closes #15 (all four pieces: OUI, mDNS, manual labels, deep check).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

config/hosts.yaml

@@ -4,6 +4,15 @@ proxmox:
   host: 192.168.1.144
   node: pve
 
+# Target for the on-demand "deep check" device investigation (SSDP/mDNS/port
+# scan). This is CT122's OWN host, since multicast needs real network access
+# — see docs/device-discovery.md. Same monitor_ed25519 key as sshHosts below,
+# but a separate authorized_keys entry on CT122 itself with a parameterized
+# forced command (reads $SSH_ORIGINAL_COMMAND for the target IP).
+deepCheck:
+  host: 192.168.1.103
+  username: root
+
 # Bare-metal boxes Proxmox can't see. Connects with the dedicated
 # `monitor` SSH key (see docs/ssh-collector-key-setup.md), read-only commands only.
 sshHosts: