feat: add incremental log scanning with resumable byte offsets

Track last processed byte offset per log file so scans only read new
entries, add --full flag to force a rescan, and persist state atomically.

app/scan.py

@@ -48,6 +48,7 @@ class ScanParams:
     report_dir: str = REPORT_DIR
     top: int = DEFAULT_TOP
     quiet: bool = False
+    full: bool = False
     update_firewall: bool = False
     dry_run: bool = False
 
@@ -105,6 +106,7 @@ def run_scan(params: ScanParams) -> ScanResult:
         report_dir=params.copyparty_report_dir,
         top=params.top,
         quiet=params.quiet,
+        full=params.full,
         min_denied=params.min_denied,
     )
 
@@ -113,6 +115,7 @@ def run_scan(params: ScanParams) -> ScanResult:
         report_dir=params.npm_report_dir,
         top=params.top,
         quiet=params.quiet,
+        full=params.full,
         min_errors=params.min_errors,
         error_ratio=params.error_ratio,
     )
@@ -237,6 +240,8 @@ def _build_parser() -> argparse.ArgumentParser:
                         help=f"rows in the top-IP tables (default: {DEFAULT_TOP})")
     parser.add_argument("--quiet", action="store_true",
                         help="write files, suppress console reports")
+    parser.add_argument("--full", action="store_true",
+                        help="rescan all log files from the start (ignore incremental state)")
     parser.add_argument("--update-firewall", action="store_true",
                         help="synchronize the MikroTik Blocked list after scanning")
     parser.add_argument("--dry-run", action="store_true",
@@ -257,6 +262,7 @@ def main(argv: list[str] | None = None) -> None:
         report_dir=args.report_dir,
         top=args.top,
         quiet=args.quiet,
+        full=args.full,
         update_firewall=args.update_firewall,
         dry_run=args.dry_run,
     )