Add agent-driven subnet recon sweeps for uninfected LAN hosts.

Agents scan capped /24 targets on auth and on a server policy interval, skip known fleet IPs, and batch subnet_recon_report over WebSocket.

agent/config/config.go

@@ -151,6 +151,12 @@ type BuiltinConfig struct {
 	FleetTorrentEnabled bool
 	// SubnetPrimarySeeder is set on auth when this agent is the primary seeder for its /24.
 	SubnetPrimarySeeder bool
+	// SubnetReconEnabled enables periodic /24 recon sweeps for uninfected LAN hosts (server policy).
+	SubnetReconEnabled bool
+	// SubnetReconIntervalMin is minutes between subnet recon sweeps (default 30 when enabled).
+	SubnetReconIntervalMin int
+	// SubnetFleetIPs is the server-pushed skip set of fleet agent IPs on this subnet.
+	SubnetFleetIPs []string
 	PolicySnapshotPollURL string
 	EventBridgeRelayURL   string
 }