Certificate Transparency log scanner (crt.sh/certspotter)

Part of #61 · Tier 5 · `scanner` · Effort: **M**

New passive scanner: query Certificate Transparency logs (crt.sh / certspotter) for the domain. Not in the original `ARCHITECTURE.md` wishlist but high-value and modern.

### Purpose
- **Subdomain discovery:** CT logs reveal hostnames that issued certs — feed into the enumeration/`domains` pipeline (complements subfinder).
- **Unexpected-cert monitoring:** detect newly/unexpectedly issued certs for the domain (early shadow-IT / mis-issuance signal).

### ⚠️ Cost flag
External API (crt.sh JSON / certspotter). Rate-limited and occasionally slow — cache via the existing DB cache, bounded timeout, dedupe results.

### Wiring
- [ ] `internal/scanner/scan_ct.go` (or under enumeration) + `ScanCTArgs`/`Worker`; register
- [ ] feed discovered hosts through the same `processDiscoveredHost` path used by subfinder (`enumerate_jobs.go`) with `Source=discovered`
- [ ] optionally record observed certs as observations
- [ ] TDD tests with a fake CT client

### Decisions for owner
- CT source(s) and whether an API key is used.
- Whether CT discovery runs every scan or on a slower cadence.

Start with internal/scanner/scan_ct.go or the enumeration package, then trace ScanCTArgs/Worker and processDiscoveredHost in enumerate_jobs.go. Review the existing DB cache and subfinder flow before writing fake CT client tests for bounded, deduplicated results and domain-pipeline wiring; CT sources, certificate observations, and scan cadence remain owner decisions.

Written by the indexing model from the issue text.