Show services discovered by site agents as suggested targets

Stores the sanitised list per site, serves it at /sites/{id}/discovered and adds
it to the target picker. Needs a Reef release containing model.DiscoveredService.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

discovered_test.go

@@ -0,0 +1,36 @@
+package hammerhead
+
+import (
+	"strings"
+	"testing"
+
+	"git.veillax.com/Veillax/reef/model"
+)
+
+func TestCleanDiscoveredDropsBadEntriesAndBoundsText(t *testing.T) {
+	in := []model.DiscoveredService{
+		{Host: "192.168.1.5", Port: 22, Proto: "udp", Service: "ssh", Detail: "SSH-2.0", Source: "scan"},
+		{Host: "127.0.0.1", Port: 8080, Service: strings.Repeat("x", 100), Detail: strings.Repeat("d", 1000), Source: "local"},
+		{Host: "<script>", Port: 80},
+		{Host: "10.0.0.1", Port: 0},
+		{Host: "10.0.0.1", Port: 70000},
+		{Host: "10.0.0.2", Port: 80, Source: "whatever"},
+	}
+	got := cleanDiscovered(in)
+	if len(got) != 3 {
+		t.Fatalf("want 3 valid entries, got %+v", got)
+	}
+	if got[0].Proto != "tcp" || got[1].Source != "local" || len(got[1].Service) != 20 || len(got[1].Detail) != 160 || got[2].Source != "scan" {
+		t.Errorf("not normalised: %+v", got)
+	}
+	many := make([]model.DiscoveredService, 900)
+	for i := range many {
+		many[i] = model.DiscoveredService{Host: "10.0.0.1", Port: i%60000 + 1}
+	}
+	if n := len(cleanDiscovered(many)); n != 500 {
+		t.Errorf("not capped: %d", n)
+	}
+	if cleanDiscovered(nil) == nil {
+		t.Error("should be an empty list, not nil, so the API returns []")
+	}
+}