Add device discovery (UHPPOTE LAN scan) to setup

UHPPOTE controllers self-announce via UDP broadcast, but the frontend had no way
to find them — the admin had to type the serial blind. Add a generic discovery
capability and surface it in the setup wizard.

packages/devices:
- DiscoverableDriver capability + DiscoveredDevice type + isDiscoverable() guard
  on the registry (optional, so any driver can opt in).
- uhppote driver implements discover() via uhppoted getDevices (UDP broadcast),
  mapping each controller's serial/IP/firmware into a DiscoveredDevice; extract
  shared buildCtx().

apps/server:
- GET /api/setup/discover/:driverId (admin-only): runs discover() and
  health-checks each found device so reachability shows before assigning.
- catalog now returns a `discoverable` driver-id list.

apps/web:
- SetupWizard "Scan for controllers" button for discoverable drivers; lists found
  devices with health badges; selecting one auto-fills serial + host. api client
  gains discoverDevices().

wiki: new device-discovery concept; cross-link from registry/setup/uhppote;
note the broadcast-permission (EACCES) deployment caveat; index + log.

Verified: catalog flags uhppote discoverable; discover runs and fails gracefully
without hardware; non-discoverable driver -> 400; missing token -> 401.

wiki/log.md

@@ -40,3 +40,15 @@ access driver (pulseOpen→openDoor, healthCheck→getStatus), registered in the
 catalog. CJS interop: default-import + destructure. Verified it builds, appears
 in the catalog, and degrades to "offline" gracefully without hardware. Real
 on-VLAN test still pending.
+
+## [2026-06-15] feature | Device discovery (UHPPOTE scan in setup)
+The frontend had no way to find a UHPPOTE — but the controllers self-announce via
+UDP broadcast. Added a generic [[device-discovery]] capability: optional
+`DiscoverableDriver.discover()` on the registry, implemented by the `uhppote`
+driver via `getDevices`. New admin-only `GET /api/setup/discover/:driverId`
+(health-checks each found device); catalog now returns a `discoverable` list.
+SetupWizard gains a "Scan for controllers" button that lists found devices with
+health badges and auto-fills serial + host on selection. Verified: catalog flags
+uhppote; discover runs and fails gracefully without hardware (broadcast EACCES);
+non-discoverable driver → 400; no token → 401. Modeled generically so cameras
+(ONVIF) can add discovery later.