Consolidate active-scan notifications and scrub private data

Active scanners (ARP, SNMP) now accumulate every change across a whole
scan and emit one notification per type via events::notify: a single
device produces the usual single-device notification (carrying its MAC),
while two or more produce one consolidated summary with an empty
mac_address. Device events are still recorded per device.

Notification bodies no longer include MAC or IP addresses; the title
MAC fallback is masked to the last two octets. Summaries list up to
three devices then "…and N more devices".

Split sighting handling so record_sighting persists + records the event
and returns Vec<DeviceChange>; passive listeners (mDNS, SSDP, DHCP) use
record_and_notify since they see one device per event.

Also fixes NotificationType::from_str never mapping "DeviceChanged",
which made those notifications round-trip from the DB as Other.

Frontend: the card already hides the device link when mac_address is
null; added widget tests for the present/absent link cases.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/scanners/ssdp/scanner.rs

@@ -76,6 +76,6 @@ async fn process_announcement(
     // mirrors the mDNS scanner so build_device can still deduce a vendor for privacy MACs.
     let device = build_device(mac.clone(), src_ip.to_string(), &device_types, server_hint);
 
-    pipeline::record_sighting(device, DeviceEventScanner::Ssdp);
+    pipeline::record_and_notify(device, DeviceEventScanner::Ssdp);
     status::STATUS.record_discovery(&mac);
 }