Add optional Fingerbank device fingerprinting to deep-check

Folded into the existing on-demand Deep check button: queries
Fingerbank's interrogate API with the device's MAC plus the SSDP
SERVER header when deep-check-device.sh finds one, showing the
confidence band alongside the result. Runs directly from the API
container (no host-level access needed, just an outbound HTTPS call),
unlike the SSDP/mDNS steps.

Confirmed via direct testing: without DHCP fingerprint data (which we
structurally don't have, not being the DHCP server), MAC-only queries
often can't get past manufacturer-level confidence -- same info the
free OUI lookup already provides. Documented honestly in
docs/device-discovery.md rather than overselling it. Still worth
having as opt-in enrichment for devices that do expose richer signals.

Gated behind optional FINGERBANK_API_KEY -- missing key, API errors,
or no match all degrade gracefully without affecting the rest of
deep-check's local findings.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/config/index.ts

@@ -55,6 +55,7 @@ export interface AppConfig {
   discoveryFilePath: string;
   oidc: OidcConfig | undefined;
   deepCheck: DeepCheckHostConfig | undefined;
+  fingerbankApiKey: string | undefined;
   hosts: HostsConfig;
 }
 
@@ -136,6 +137,7 @@ export function loadConfig(hostsConfigPath: string): AppConfig {
           privateKeyPath: sshPrivateKeyPath,
         }
       : undefined,
+    fingerbankApiKey: process.env.FINGERBANK_API_KEY,
     hosts,
   };
 }