Add device discovery (UHPPOTE LAN scan) to setup

UHPPOTE controllers self-announce via UDP broadcast, but the frontend had no way
to find them — the admin had to type the serial blind. Add a generic discovery
capability and surface it in the setup wizard.

packages/devices:
- DiscoverableDriver capability + DiscoveredDevice type + isDiscoverable() guard
  on the registry (optional, so any driver can opt in).
- uhppote driver implements discover() via uhppoted getDevices (UDP broadcast),
  mapping each controller's serial/IP/firmware into a DiscoveredDevice; extract
  shared buildCtx().

apps/server:
- GET /api/setup/discover/:driverId (admin-only): runs discover() and
  health-checks each found device so reachability shows before assigning.
- catalog now returns a `discoverable` driver-id list.

apps/web:
- SetupWizard "Scan for controllers" button for discoverable drivers; lists found
  devices with health badges; selecting one auto-fills serial + host. api client
  gains discoverDevices().

wiki: new device-discovery concept; cross-link from registry/setup/uhppote;
note the broadcast-permission (EACCES) deployment caveat; index + log.

Verified: catalog flags uhppote discoverable; discover runs and fails gracefully
without hardware; non-discoverable driver -> 400; missing token -> 401.

wiki/concepts/first-run-setup.md

@@ -16,7 +16,8 @@ each device's connection config.
 ## Flow
 
 1. **Read the catalog** — `GET /api/setup/catalog` returns supported drivers per category (no
-   secrets, just schema). The web `SetupWizard` renders a picker + the driver's config fields.
+   secrets, just schema) plus a `discoverable` list. The web `SetupWizard` renders a picker + the
+   driver's config fields, and a **Scan** button for discoverable drivers ([[device-discovery]]).
 2. **Assign per lane** — `POST /api/setup/assign` (admin-only, role-guarded; see
    [[local-jwt-auth]]). The server validates the chosen driver + config against the registry
    before persisting to the `lane_devices` table; unknown drivers / missing required fields are