feat: Phase 1 scaffold — frontend canvas + backend skeleton

Frontend:
- Vite + React 18 + TypeScript + Tailwind v4 + Shadcn/ui
- React Flow v12 canvas with all 11 node types and 5 edge types
- Dark theme with project design system (cyan, green, orange, purple accents)
- Collapsible sidebar, toolbar, detail panel
- Zustand store for canvas state
- Demo data with 10 nodes and 10 edges

Backend:
- FastAPI + SQLAlchemy async + SQLite (Python 3.13)
- DB models: Node, Edge, CanvasState, PendingDevice, ScanRun
- REST API routes: auth, nodes, edges, canvas, scan, status (WebSocket)
- JWT auth + bcrypt via config.yml
- Pydantic v2 schemas

Infra:
- GitHub Actions quality + security workflows
- .gitignore, .env.example, verify-tooling.sh, security-check.sh

backend/app/api/routes/scan.py

@@ -0,0 +1,44 @@
+from fastapi import APIRouter, Depends
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.api.deps import get_current_user
+from app.db.database import get_db
+from app.db.models import PendingDevice, ScanRun
+from app.schemas.scan import PendingDeviceResponse, ScanRunResponse
+
+router = APIRouter()
+
+
+@router.post("/trigger", response_model=ScanRunResponse)
+async def trigger_scan(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
+    run = ScanRun(status="running", ranges=[])
+    db.add(run)
+    await db.commit()
+    await db.refresh(run)
+    # TODO: launch scanner in background thread
+    return run
+
+
+@router.get("/pending", response_model=list[PendingDeviceResponse])
+async def list_pending(db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
+    result = await db.execute(select(PendingDevice).where(PendingDevice.status == "pending"))
+    return result.scalars().all()
+
+
+@router.post("/pending/{device_id}/approve")
+async def approve_device(device_id: str, db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
+    device = await db.get(PendingDevice, device_id)
+    if device:
+        device.status = "approved"
+        await db.commit()
+    return {"approved": True}
+
+
+@router.post("/pending/{device_id}/hide")
+async def hide_device(device_id: str, db: AsyncSession = Depends(get_db), _: str = Depends(get_current_user)):
+    device = await db.get(PendingDevice, device_id)
+    if device:
+        device.status = "hidden"
+        await db.commit()
+    return {"hidden": True}