Report discovered printers to the cloud, off by default

The gateway could already find printers; only a human reading a terminal
could see the result. So adding a printer in the web console still began with
walking to a machine to read its IP address off the screen.

Now a background task scans on a timer and sends a `discovered_printers`
frame. It cannot finish the job - the credential is on that screen and no
probe can read it - but it removes the address, the serial and the guesswork
about which vendor the thing is.

OFF by default, which is the load-bearing part of this commit. A /24 sweep is
254 TLS handshakes and up to three HTTP requests per host, and nothing
watching can tell that from a port scan; on a corporate network, being
indistinguishable from a port scan is itself the problem. A gateway that did
this by default would scan networks its operator never meant to point it at,
and the first they would hear of it is from their own security team. So:

- `discovery.enabled` is false unless set, per gateway, in that gateway's own
  config. The cloud cannot switch it on. A setting whose whole purpose is to
  bound what this process does to the local network has to be decided where
  that network is understood, which is not in a data centre.
- `subnets` is explicit, never derived from this host's interfaces, so a
  second NIC, a VPN or a container bridge cannot widen the sweep. Anything
  wider than a /24 is still refused, now at config-import time rather than
  when the timer first fires.
- A flag that is neither `true` nor `false` is an error, not a shrug. The two
  readings of a typo are not equally safe.
- Naming a subnet without setting `enabled` scans nothing - the safe reading
  of an incomplete instruction - and `enabled` with nowhere to look is
  refused as the mistake it is.
- The env var can switch it *off* over a file that enables it, which is the
  direction that has to work: a Proxy Box's config is signed in the cloud, so
  an operator who finds their gateway probing cannot just edit it.

What a scheduled scan will not do, unlike the example CLI: send `M115`.
Opening a serial port toggles DTR, which reboots an Arduino-based board and
ruins a print in progress. The example can do it behind
`--yes-reset-the-printer` because a human is standing there; a timer has
nobody to ask, so it does not get the option and reads sysfs instead.

Two things that took more care than expected:

`Scan::looked()`. An empty report means "this gateway looked and its network
has no unconfigured printers", so sending one after every probe failed would
state something untrue about the farm. A partial failure is still evidence,
though - withholding a good sweep because a container can never bind SSDP
would suppress it forever - so the test is "did anything succeed", not "did
everything".

`fleet::configured()` reads the fleet file at parse level rather than through
`load`, because the entry it most needs to recognise is the one `load`
refuses: a printer discovery suggested, pasted in, with the access code not
yet typed in. Re-offering that printer as a fresh find is noise at the one
moment the operator is mid-way through adding it.

Verified against the real LAN: a sweep found both printers by TLS certificate
with correct serials and no credentials, and the frame it produced validates
against the backend's EdgeClientMessageSchema. The `wire` subcommand on the
example prints exactly that frame, and the capture is pinned as a backend
fixture. SSDP remains untestable here - this container is a router hop from
the printers and multicast does not cross one.

examples/discover_printers.rs

@@ -7,6 +7,7 @@
 //! cargo run --example discover_printers -- identify <host>... # one known address
 //! cargo run --example discover_printers -- sweep <a.b.c.0/24> # every address on a segment
 //! cargo run --example discover_printers -- serial             # USB/serial ports, passive
+//! cargo run --example discover_printers -- wire [subnet] [--ssdp]  # the frame the daemon sends
 //! cargo run --example discover_printers -- serial-probe <port> [baud] --yes-reset-the-printer
 //! ```
 //!
@@ -114,6 +115,50 @@ async fn main() -> anyhow::Result<()> {
             println!("opening {port} at {baud} baud - this resets the board; waiting for it to boot ...");
             vec![serial::probe_m115(port, baud, SERIAL_TIMEOUT).await?]
         }
+        // Not merged with the others, because this one answers a different
+        // question: not "what is out there" but "what exactly would the
+        // daemon send about it". So it runs the real `scan` - the same
+        // function the background task calls, with the same fleet filtering
+        // and the same refusal to open a serial port - and prints the frame.
+        //
+        // The reason to have it: the gateway and the backend agree about this
+        // message only by hand, and a frame captured from real hardware is
+        // the only thing that proves the two halves match. See
+        // `continuum-backend/tests/edge_protocol.test.ts`, which validates
+        // captures like this one.
+        "wire" => {
+            let settings = continuum_proxy::config::DiscoverySettings {
+                enabled: true,
+                subnets: args.get(1).map(|s| vec![s.clone()]).unwrap_or_default(),
+                // On by default here and off in the daemon: a human asked for
+                // this one and is waiting for the output.
+                ssdp: args.iter().any(|a| a == "--ssdp"),
+                serial: true,
+                interval: Duration::from_secs(60),
+            };
+            let path = std::env::var("CONTINUUM_PRINTERS_PATH").unwrap_or_else(|_| "printers.toml".into());
+            let configured = continuum_proxy::fleet::configured(std::path::Path::new(&path))?;
+            let scan = discovery::scan::scan(&settings, &configured).await;
+            if !scan.looked() {
+                anyhow::bail!("every discovery source failed, so there is nothing to report");
+            }
+            let printers: Vec<_> = scan.candidates.iter().map(Candidate::to_wire).collect();
+            let count = printers.len();
+            // The real enum through the real serializer, not a hand-built
+            // JSON object. A hand-built one would agree with this file rather
+            // than with the daemon, which is the whole thing this subcommand
+            // exists to rule out.
+            let frame = continuum_proxy::uplink::ClientMessage::DiscoveredPrinters {
+                printers,
+                scanned_at: discovery::report::now_rfc3339(),
+            };
+            println!("{}", serde_json::to_string_pretty(&frame)?);
+            eprintln!(
+                "({count} candidate(s) after removing anything {path} already names; point \
+                 CONTINUUM_PRINTERS_PATH at an empty file to see them all)"
+            );
+            return Ok(());
+        }
         other => anyhow::bail!("unknown command {other:?}\n{}", usage()),
     };
 
@@ -123,7 +168,8 @@ async fn main() -> anyhow::Result<()> {
 
 fn usage() -> String {
     "usage: discover_printers all [subnet] | listen [seconds] | raw [seconds] | identify <host>... \
-     | sweep <a.b.c.0/24> | serial | serial-probe <port> [baud] --yes-reset-the-printer"
+     | sweep <a.b.c.0/24> | serial | wire [subnet] [--ssdp] \
+     | serial-probe <port> [baud] --yes-reset-the-printer"
         .to_string()
 }