Add device discovery (UHPPOTE LAN scan) to setup

UHPPOTE controllers self-announce via UDP broadcast, but the frontend had no way
to find them — the admin had to type the serial blind. Add a generic discovery
capability and surface it in the setup wizard.

packages/devices:
- DiscoverableDriver capability + DiscoveredDevice type + isDiscoverable() guard
  on the registry (optional, so any driver can opt in).
- uhppote driver implements discover() via uhppoted getDevices (UDP broadcast),
  mapping each controller's serial/IP/firmware into a DiscoveredDevice; extract
  shared buildCtx().

apps/server:
- GET /api/setup/discover/:driverId (admin-only): runs discover() and
  health-checks each found device so reachability shows before assigning.
- catalog now returns a `discoverable` driver-id list.

apps/web:
- SetupWizard "Scan for controllers" button for discoverable drivers; lists found
  devices with health badges; selecting one auto-fills serial + host. api client
  gains discoverDevices().

wiki: new device-discovery concept; cross-link from registry/setup/uhppote;
note the broadcast-permission (EACCES) deployment caveat; index + log.

Verified: catalog flags uhppote discoverable; discover runs and fails gracefully
without hardware; non-discoverable driver -> 400; missing token -> 401.

packages/devices/src/registry.ts

@@ -51,6 +51,33 @@ export type ReaderDriver = DeviceDriver<ReaderDevice>;
 export type CameraDriver = DeviceDriver<CameraDevice>;
 export type PrinterDriver = DeviceDriver<PrinterDevice>;
 
+/** A device found on the LAN by a driver's discovery scan. */
+export interface DiscoveredDevice {
+  /** Identifier to pre-fill (e.g. UHPPOTE serial number). */
+  readonly id: string;
+  readonly label: string;
+  /** Config values to auto-fill into the setup form (host, serial, …). */
+  readonly config: DeviceConfig;
+  /** Extra info to show the admin (firmware, MAC, netmask, …). */
+  readonly info?: Record<string, string>;
+}
+
+/**
+ * Optional capability: a driver that can find devices on the LAN. UHPPOTE
+ * implements this via the protocol's UDP broadcast discovery (get-devices);
+ * cameras (ONVIF) and others may add it later. See wiki/concepts/device-discovery.md.
+ */
+export interface DiscoverableDriver {
+  discover(): Promise<DiscoveredDevice[]>;
+}
+
+/** Type guard: does this driver support discovery? */
+export function isDiscoverable(
+  driver: DeviceDriver,
+): driver is DeviceDriver & DiscoverableDriver {
+  return typeof (driver as Partial<DiscoverableDriver>).discover === "function";
+}
+
 class DeviceRegistry {
   readonly #drivers = new Map<string, DeviceDriver>();