Recon network batch 2: fleet relay scan and UDP hints.

POST /api/v1/recon/relay-scan probes from the dashboard when reachable, otherwise dispatches recon_relay_scan to a same-/24 online agent. Agents reuse probePortsFn for TCP and optionally UDP 53/51820 with dns/wireguard Path Tracer tags.

server/internal/recon/relay_scan_test.go

@@ -0,0 +1,19 @@
+package recon
+
+import "testing"
+
+func TestHostReachableHook(t *testing.T) {
+	SetHostReachableHook(func(host string) bool { return host == "10.0.0.5" })
+	t.Cleanup(func() { SetHostReachableHook(nil) })
+	if !HostReachable("10.0.0.5") || HostReachable("10.0.0.6") {
+		t.Fatal("reachability hook mismatch")
+	}
+}
+
+func TestMergeAgentRelayScanWireguardHint(t *testing.T) {
+	payload := []byte(`{"open_ports":[22],"udp_hints":[{"port":51820,"open":true,"service":"wireguard"}]}`)
+	merged, err := MergeAgentRelayScan(RelayScanReport{Host: "10.1.2.50", ScannedVia: "relay"}, payload, false)
+	if err != nil || len(merged.PathTracerHints) != 1 || merged.PathTracerHints[0] != "wireguard" {
+		t.Fatalf("merged=%+v err=%v", merged, err)
+	}
+}