Add passive mDNS/Bonjour discovery scanner

Introduce a second discovery module that passively listens for mDNS
multicast announcements (224.0.0.251:5353) and feeds discovered devices
into the existing devices/events/notifications pipeline, running in its
own task alongside the ARP scanner.

Since mDNS carries an IP and hostname but no MAC (the device key), the
module resolves IP->MAC via the OS ARP cache with a targeted ARP-probe
fallback. The advertised hostname is stored in a new optional `name`
column on devices (blank for ARP-only devices); the single `update`
writes `name` only when set so ARP rescans never clobber it. Device
names are included in event/notification messages.

Adds a GET /api/mdns_scanner/status endpoint (is_listening, devices_seen,
last_device_seen_seconds_ago) wired into OpenAPI, an optional
[mdns_scanner] config section, and the corresponding Nix module option.
Also aligns the Nix module's stale `timings` section with the current
`arp_scanner` schema.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/src/web_server/mdns_scanner.rs

@@ -0,0 +1,59 @@
+use axum::{Json, http::StatusCode};
+use chrono::Utc;
+use log::error;
+use serde::Serialize;
+use utoipa::ToSchema;
+
+use crate::mdns_scanner_status;
+
+#[derive(Serialize, ToSchema)]
+pub struct MdnsScannerStatusResponse {
+    pub is_listening: bool,
+    /// Seconds the listener has been running (only set when is_listening is true)
+    pub listening_for_seconds: Option<f64>,
+    /// Total device announcements processed since the listener started
+    pub devices_seen: u64,
+    /// Seconds since the last device was seen (None if none seen yet)
+    pub last_device_seen_seconds_ago: Option<f64>,
+}
+
+#[utoipa::path(
+    get,
+    path = "/api/mdns_scanner/status",
+    tag = "mdns_scanner",
+    responses(
+        (status = 200, description = "mDNS scanner status", body = MdnsScannerStatusResponse),
+        (status = 500, description = "Internal server error"),
+    ),
+    security(("bearer_auth" = []))
+)]
+pub async fn status() -> Result<Json<MdnsScannerStatusResponse>, StatusCode> {
+    let snapshot = match mdns_scanner_status::get() {
+        Some(s) => s,
+        None => {
+            error!("mDNS scanner status not initialized");
+            return Err(StatusCode::INTERNAL_SERVER_ERROR);
+        }
+    };
+
+    let now = Utc::now();
+
+    let listening_for_seconds = if snapshot.is_listening {
+        snapshot
+            .listening_since
+            .map(|t| (now - t).num_milliseconds() as f64 / 1000.0)
+    } else {
+        None
+    };
+
+    let last_device_seen_seconds_ago = snapshot
+        .last_discovery_at
+        .map(|t| ((now - t).num_milliseconds() as f64 / 1000.0).max(0.0));
+
+    Ok(Json(MdnsScannerStatusResponse {
+        is_listening: snapshot.is_listening,
+        listening_for_seconds,
+        devices_seen: snapshot.devices_discovered,
+        last_device_seen_seconds_ago,
+    }))
+}