Add optional Fingerbank device fingerprinting to deep-check

Folded into the existing on-demand Deep check button: queries
Fingerbank's interrogate API with the device's MAC plus the SSDP
SERVER header when deep-check-device.sh finds one, showing the
confidence band alongside the result. Runs directly from the API
container (no host-level access needed, just an outbound HTTPS call),
unlike the SSDP/mDNS steps.

Confirmed via direct testing: without DHCP fingerprint data (which we
structurally don't have, not being the DHCP server), MAC-only queries
often can't get past manufacturer-level confidence -- same info the
free OUI lookup already provides. Documented honestly in
docs/device-discovery.md rather than overselling it. Still worth
having as opt-in enrichment for devices that do expose richer signals.

Gated behind optional FINGERBANK_API_KEY -- missing key, API errors,
or no match all degrade gracefully without affecting the rest of
deep-check's local findings.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/src/db/index.ts

@@ -205,6 +205,13 @@ export function getRecentDevices(db: Database.Database, sinceHours = 24): Device
     .all({ cutoff: `-${sinceHours} hours` }) as DeviceRow[];
 }
 
+export function getDeviceMac(db: Database.Database, ip: string): string | null {
+  const row = db.prepare(`SELECT mac FROM devices WHERE ip = @ip`).get({ ip }) as
+    | { mac: string }
+    | undefined;
+  return row?.mac ?? null;
+}
+
 export function setDeviceLabel(db: Database.Database, mac: string, label: string): void {
   db.prepare(
     `INSERT INTO device_labels (mac, label) VALUES (@mac, @label)