Add opt-in service discovery: local listeners and rate-limited private subnet scans

Reports identified services (HTTP, HTTPS, SSH, SMTP, FTP, ...) to Hammerhead as
suggested targets. Needs a Reef release containing model.DiscoveredService.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cmd/bamboo/main.go

@@ -7,9 +7,11 @@ import (
 	"log"
 	"os"
 	"os/signal"
+	"strconv"
 	"strings"
 
 	"git.veillax.com/Veillax/bamboo"
+	"git.veillax.com/Veillax/bamboo/discover"
 	"git.veillax.com/Veillax/reef/dotenv"
 	"git.veillax.com/Veillax/reef/selfupdate"
 )
@@ -24,6 +26,13 @@ func env(k, def string) string {
 	return def
 }
 
+func envFloat(k string, def float64) float64 {
+	if f, err := strconv.ParseFloat(os.Getenv(k), 64); err == nil && f > 0 {
+		return f
+	}
+	return def
+}
+
 func main() {
 	// secrets (tokens, DNS-provider credentials) can live in a .env file instead of the command line
 	envFile := dotenv.ArgPath(os.Args[1:], ".env")
@@ -34,6 +43,10 @@ func main() {
 	token := flag.String("token", env("BAMBOO_TOKEN", ""), "site token from the hammerhead UI")
 	data := flag.String("data", env("BAMBOO_DATA", "./bamboo-data"), "directory for this agent's WireGuard key")
 	dockerOn := flag.Bool("docker", os.Getenv("BAMBOO_DOCKER") == "1", "report local Docker containers so they can be picked as targets in the UI")
+	discoverOn := flag.Bool("discover", os.Getenv("BAMBOO_DISCOVER") == "1", "report services listening on this machine as suggested targets in the UI (Linux)")
+	discoverSubnets := flag.String("discover-subnets", os.Getenv("BAMBOO_DISCOVER_SUBNETS"), "comma-separated private subnets to scan for services, e.g. 192.168.1.0/24 (at most /22 each; off by default)")
+	discoverPorts := flag.String("discover-ports", os.Getenv("BAMBOO_DISCOVER_PORTS"), "TCP ports to try on scanned addresses, e.g. 22,80,443,8000-8010 (default: a short list of common ones)")
+	discoverRate := flag.Float64("discover-rate", envFloat("BAMBOO_DISCOVER_RATE", discover.DefaultRate), "most connection attempts per second discovery may make")
 	flag.String("env", ".env", "file to read secrets and settings from")
 	autoUpdate := flag.Bool("auto-update", os.Getenv("BAMBOO_AUTO_UPDATE") == "1", "check for new releases every few hours and update and restart by itself (Linux and macOS)")
 	showVersion := flag.Bool("version", false, "print the version and exit")
@@ -53,7 +66,15 @@ func main() {
 	if *autoUpdate {
 		go selfupdate.Run(ctx, upd)
 	}
-	b, err := bamboo.New(bamboo.Config{Hammerhead: strings.TrimRight(*hh, "/"), Token: *token, DataDir: *data, Docker: *dockerOn,
+	dc := discover.Config{Local: *discoverOn || *discoverSubnets != "", Rate: *discoverRate}
+	var err error
+	if dc.Subnets, err = discover.ParseSubnets(*discoverSubnets); err != nil {
+		log.Fatalf("-discover-subnets: %v", err)
+	}
+	if dc.Ports, err = discover.ParsePorts(*discoverPorts); err != nil {
+		log.Fatalf("-discover-ports: %v", err)
+	}
+	b, err := bamboo.New(bamboo.Config{Hammerhead: strings.TrimRight(*hh, "/"), Token: *token, DataDir: *data, Docker: *dockerOn, Discover: dc,
 		Version: version, AutoUpdate: *autoUpdate,
 		UpdateNow: func(ctx context.Context, progress func(string, int, string)) (string, error) {
 			c := upd