Add optional Fingerbank device fingerprinting to deep-check

Folded into the existing on-demand Deep check button: queries
Fingerbank's interrogate API with the device's MAC plus the SSDP
SERVER header when deep-check-device.sh finds one, showing the
confidence band alongside the result. Runs directly from the API
container (no host-level access needed, just an outbound HTTPS call),
unlike the SSDP/mDNS steps.

Confirmed via direct testing: without DHCP fingerprint data (which we
structurally don't have, not being the DHCP server), MAC-only queries
often can't get past manufacturer-level confidence -- same info the
free OUI lookup already provides. Documented honestly in
docs/device-discovery.md rather than overselling it. Still worth
having as opt-in enrichment for devices that do expose richer signals.

Gated behind optional FINGERBANK_API_KEY -- missing key, API errors,
or no match all degrade gracefully without affecting the rest of
deep-check's local findings.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -44,3 +44,10 @@ SNAPSHOT_RETENTION_HOURS=24
 # Dedicated key for SshHostCollector (omv, ripper) — see docs/ssh-collector-key-setup.md.
 # In docker-compose this is mounted from ./ssh/monitor_ed25519 (gitignored, not this path).
 SSH_PRIVATE_KEY_PATH=./ssh/monitor_ed25519
+
+# Optional. Free API key from fingerbank.org — enriches the "Deep check" button's
+# results with device fingerprinting (MAC + any SSDP signal found). Without a DHCP
+# fingerprint (which we don't have access to, not being the DHCP server), this often
+# only reaches manufacturer-level confidence, same as the free OUI lookup — see
+# docs/device-discovery.md. Omit entirely to skip this enrichment.
+FINGERBANK_API_KEY=