Add browser deploy recon backend with port scan, web crawl, and deploy lane recommendations.

POST /api/v1/recon/scan probes fleet ports from the server host, crawls owned HTTP targets, maps findings to spread lanes, and records optional oath ledger rows.

server/internal/recon/portscan.go

@@ -0,0 +1,32 @@
+package recon
+
+import (
+	"net"
+	"strconv"
+	"time"
+)
+
+// dialPortFn overrides TCP probes in tests (nil = live dial from server host).
+var dialPortFn func(host string, port int, timeout time.Duration) bool
+
+// ScanPorts TCP-dials common fleet ports on host with timeout from server host.
+func ScanPorts(host string) []PortResult {
+	out := make([]PortResult, 0, len(FleetPorts))
+	for _, port := range FleetPorts {
+		out = append(out, PortResult{Port: port, Open: dialPort(host, port, DefaultPortDialTimeout)})
+	}
+	return out
+}
+
+func dialPort(host string, port int, timeout time.Duration) bool {
+	if dialPortFn != nil {
+		return dialPortFn(host, port, timeout)
+	}
+	addr := net.JoinHostPort(host, strconv.Itoa(port))
+	conn, err := net.DialTimeout("tcp", addr, timeout)
+	if err != nil {
+		return false
+	}
+	_ = conn.Close()
+	return true
+}