Service-discovery / open-port scanner + OpenPortAssessor

Part of #61 · Tier 5 · `scanner` `assessor` · Effort: **L**

New service-discovery scanner + wire up the dormant `open_port_findings` table (`OpenPortAssessor` in the wishlist).

### Scanner
- Probe a **curated** port set against resolved A/AAAA + MX IPs:
- web: 80, 443, 8080, 8443
- mail: 25, 465, 587, 110, 143, 993, 995
- admin/risky: 22, 3389, 5432, 3306, 6379, 27017, 9200 (configurable)
- TCP connect (banner optional). New scan job + queue/concurrency tuning.

### Assessor
- Flag unexpected/risky exposed services (e.g. database ports, RDP, exposed admin) on domain IPs.

### ⚠️ Cost / safety flags (project rule — heaviest item)
- Outbound TCP at scale; may trip target IDS/IPS and raises ToS/legal questions. **Feature-flag off by default** (`SERVICE_DISCOVERY_ENABLED`).
- Route through rate limiter; bound concurrency per host; respect a deny-list.
- Consider a dedicated queue separate from DNS scanners.

### Wiring
- [ ] `internal/scanner/scan_ports.go` + `ScanPortsArgs`/`Worker`; register; enqueue in `EnqueueDomainScan` (gated by flag)
- [ ] projection table for raw port results (or store on the finding)
- [ ] `AssessOpenPortsArgs` + worker; `(a *Assessor) AssessOpenPorts`
- [ ] sqlc for `open_port_findings`; `task sqlc`; observer entities; UNION/service/UI surfacing
- [ ] TDD tests (mock dialer)

### Decisions for owner
- Default port set + risky-port severity policy.
- Whether banner grabbing is in scope.

Start with the wiring checklist in the issue and inspect internal/scanner/scan_ports.go, ScanPortsArgs/Worker, EnqueueDomainScan, and the OpenPortAssessor entry points. Run task sqlc when working on open_port_findings, then review the observer, UNION, and UI surfacing paths. Done means the feature is flag-gated, rate-limited with bounded concurrency and a deny-list, and covered by TDD tests using a mock dialer.

Written by the indexing model from the issue text.