Add device discovery (UHPPOTE LAN scan) to setup

UHPPOTE controllers self-announce via UDP broadcast, but the frontend had no way
to find them — the admin had to type the serial blind. Add a generic discovery
capability and surface it in the setup wizard.

packages/devices:
- DiscoverableDriver capability + DiscoveredDevice type + isDiscoverable() guard
  on the registry (optional, so any driver can opt in).
- uhppote driver implements discover() via uhppoted getDevices (UDP broadcast),
  mapping each controller's serial/IP/firmware into a DiscoveredDevice; extract
  shared buildCtx().

apps/server:
- GET /api/setup/discover/:driverId (admin-only): runs discover() and
  health-checks each found device so reachability shows before assigning.
- catalog now returns a `discoverable` driver-id list.

apps/web:
- SetupWizard "Scan for controllers" button for discoverable drivers; lists found
  devices with health badges; selecting one auto-fills serial + host. api client
  gains discoverDevices().

wiki: new device-discovery concept; cross-link from registry/setup/uhppote;
note the broadcast-permission (EACCES) deployment caveat; index + log.

Verified: catalog flags uhppote discoverable; discover runs and fails gracefully
without hardware; non-discoverable driver -> 400; missing token -> 401.

wiki/entities/uhppote-controller.md

@@ -17,8 +17,10 @@ is UHPPOTE now → ZKTeco later (see [[bom]]). (See [[parking-system-architectur
 > design needs: `openDoor`, `getStatus`, and the event-log set (`getEvent`, `getEventIndex`,
 > `setEventIndex`, `recordSpecialEvents`) plus `setListener`/`listen` for auto-push — see
 > [[event-log-ingestion]]. Transport defaults to **UDP** (broadcast `…:60000`), with optional
-> per-call TCP on newer firmware. Note: the lib pulls one trivial extra dep (the npm `os`
-> shim) and tends to use UDP broadcast, which needs socket broadcast permission on the host.
+> per-call TCP on newer firmware. The driver also implements **[[device-discovery]]**
+> (`getDevices` broadcast) so the setup wizard can scan for controllers. Note: the lib pulls one
+> trivial extra dep (the npm `os` shim) and uses UDP broadcast, which needs socket broadcast
+> permission on the host.
 
 ## What it is