refactor: decompose four WS-D god-files by role (arp, users, snmp, engine)

[krisarmstrong]

Summary

Bundled WS-D god-file decomposition — four independent pure-move splits, one
commit each, each file relocated by role with no behavior change:

Original (LOC)	Split into
internal/discovery/enumerate/arp.go (750)	arp.go (scanner type + config/result accessors) · arpscan.go (subnet scan / ping sweep) · arpenrich.go (ARP-table read + enrichment)
internal/database/users.go (731)	users.go (user CRUD) · users_auth.go (login/lockout/token-version) · users_sso.go (SSO upsert/lookup) — follows the existing users_*.go convention
internal/discovery/snmp_collector.go (688)	snmp_collector.go (types + collect orchestration/dispatch) · snmpcollectors.go (per-area low-level collectors)
internal/discovery/engine.go (678)	engine.go (types, config, setters, lifecycle) · scan.go (scan orchestration/phases)

Bundled into one PR (rather than four) to avoid the required-up-to-date
branch-protection merge cascade. Every split file is now under the 600-line
size gate.

Linked Issue

Related to #187

Type of Change

• Chore / refactor / dependency update

Risk

• Low

Testing Evidence

Each of the four splits independently verified pure-move (declaration sets +
code-line multisets identical to the original), then the combined bundle
gated from a clean worktree off origin/main:

per-file pure-move proofs (×4):   ✅ DECL + CODE IDENTICAL
gofmt -l:                         clean
go build ./internal/discovery/... ./internal/database/...:  OK
go vet (same):                    OK
golangci-lint (same):             0 issues
go test -race ./internal/discovery/ ./internal/discovery/enumerate/:  ok
go test -race -timeout=20m ./internal/database/:  ok 842s (pre-existing slow suite; >10min default, within CI 20m)
check-filename-policy.sh:         ✓
file-size gate:                   all touched/new files <600

Security and Release Checklist

• No secrets, tokens, credentials, or customer data are included.
• Mutating routes, auth surfaces, permission checks, and output encoding were reviewed if touched. (none — pure file splits within existing packages)
• Dependencies are pinned and justified if changed. (none changed)
• Documentation, screenshots, or operator notes were updated if behavior changed. (no behavior change)

[github-actions]

📋 License Compliance Report

✅ All dependencies pass license compliance checks

Go Dependencies

• Unknown: 118 package(s)
• MIT: 30 package(s)
• BSD-3-Clause: 17 package(s)
• Apache-2.0: 12 package(s)
• BSD-2-Clause: 2 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)