Factor shared scanner logic into scanners/common

The five scanners (ARP, SNMP, mDNS, SSDP, DHCP) duplicated their
persist-and-notify pipeline, device enrichment, and status state
machines across same-family files. Extract the shared logic so a change
lands in one place instead of three to five.

- scanners/common/pipeline.rs: single record_sighting() persist+notify
  path, replacing the per-scanner match blocks. ARP/SNMP now use the
  same merge rules as the passive scanners (keep a stored hostname,
  never overwrite a known IP with an empty one).
- scanners/common/enrichment.rs: build_device() for vendor/device-type
  lookup with the privacy-MAC service fallback.
- scanners/common/{active,passive}_status.rs: the two status state
  machines plus their tests, written once. Each scanner status.rs is now
  a thin wrapper over its own static.
- utils/network::format_mac(): replaces three identical copies.
- web_server/scanner_status.rs: Active/Passive response types and two
  handler helpers, replacing five near-identical structs+handlers. JSON
  field names are unchanged so the frontend is unaffected; only OpenAPI
  schema names change.

27 files changed, ~900 lines net removed. Build, clippy and all 113
tests (4 new) pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/web_server/dhcp_scanner.rs

@@ -1,57 +1,17 @@
 use axum::{Json, http::StatusCode};
-use chrono::Utc;
-use log::error;
-use serde::Serialize;
-use utoipa::ToSchema;
 
-#[derive(Serialize, ToSchema)]
-pub struct DhcpScannerStatusResponse {
-    pub is_listening: bool,
-    /// Seconds the listener has been running (only set when is_listening is true)
-    pub listening_for_seconds: Option<f64>,
-    /// Distinct devices seen in the last hour
-    pub devices_seen: u64,
-    /// Seconds since the last device was seen (None if none seen yet)
-    pub last_device_seen_seconds_ago: Option<f64>,
-}
+use crate::web_server::scanner_status::{PassiveScannerStatusResponse, passive_response};
 
 #[utoipa::path(
     get,
     path = "/api/dhcp_scanner/status",
     tag = "dhcp_scanner",
     responses(
-        (status = 200, description = "DHCP scanner status", body = DhcpScannerStatusResponse),
+        (status = 200, description = "DHCP scanner status", body = PassiveScannerStatusResponse),
         (status = 500, description = "Internal server error"),
     ),
     security(("bearer_auth" = []))
 )]
-pub async fn status() -> Result<Json<DhcpScannerStatusResponse>, StatusCode> {
-    let snapshot = match crate::scanners::dhcp::status::get() {
-        Some(s) => s,
-        None => {
-            error!("DHCP scanner status not initialized");
-            return Err(StatusCode::INTERNAL_SERVER_ERROR);
-        }
-    };
-
-    let now = Utc::now();
-
-    let listening_for_seconds = if snapshot.is_listening {
-        snapshot
-            .listening_since
-            .map(|t| (now - t).num_milliseconds() as f64 / 1000.0)
-    } else {
-        None
-    };
-
-    let last_device_seen_seconds_ago = snapshot
-        .last_discovery_at
-        .map(|t| ((now - t).num_milliseconds() as f64 / 1000.0).max(0.0));
-
-    Ok(Json(DhcpScannerStatusResponse {
-        is_listening: snapshot.is_listening,
-        listening_for_seconds,
-        devices_seen: snapshot.devices_last_hour,
-        last_device_seen_seconds_ago,
-    }))
+pub async fn status() -> Result<Json<PassiveScannerStatusResponse>, StatusCode> {
+    passive_response(crate::scanners::dhcp::status::get()).map(Json)
 }