feat: add incremental log scanning with resumable byte offsets

Track last processed byte offset per log file so scans only read new
entries, add --full flag to force a rescan, and persist state atomically.

app/templates/scan.html

@@ -42,6 +42,10 @@
       ><input id="dry_run" type="checkbox" /> Dry-run (preview, no
       changes)</label
     >
+    <label class="check"
+      ><input id="full" type="checkbox" /> Full scan (ignore incremental
+      state)</label
+    >
   </form>
   <div class="panel-actions">
     <button class="btn primary" id="run-btn">Run scan</button>
@@ -86,6 +90,7 @@
         parseFloat(document.getElementById("error_ratio").value) || 0.5,
       update_firewall: document.getElementById("update_firewall").checked,
       dry_run: document.getElementById("dry_run").checked,
+      full: document.getElementById("full").checked,
       quiet: true,
     };
     runBtn.disabled = true;
@@ -173,6 +178,8 @@
 
   runBtn.addEventListener("click", runScan);
   refreshJobs();
-  setInterval(refreshJobs, 5000);
+  // /api/scan/status is only polled every 15 s; the active job's own
+  // 2 s poll keeps live progress without hammering the status endpoint.
+  setInterval(refreshJobs, 15000);
 </script>
 {% endblock %}