docs: document On-Demand Scan API and new env vars (weekly audit)

[krakenhavoc]

Weekly Documentation Audit — 2026-05-12

Documentation Gaps Addressed

The On-Demand Scan API was merged (PR #12) but README.md had no mention of the two new environment variables, the scan_api YAML config block, or the POST /scan endpoint.

Gap	Fix
KK_PROBE_SCAN_API_ENABLED not in env var table	Added with default false
KK_PROBE_SCAN_API_SECRET not in env var table	Added with minimum 32-character requirement
scan_api YAML block missing from config reference	Added with enabled and secret fields
POST /scan not mentioned in How It Works diagram	Added conditional step to ASCII diagram
No On-Demand Scan API section	Added section covering config, request format, response, and security guidance
No troubleshooting entry for secret length error	Added entry with openssl rand -hex 32 example

---

Files Changed

• README.md — env var table, YAML config block, new On-Demand Scan API section, How It Works diagram, troubleshooting section

---

Suggested Version Bump

The scan API was already merged in PR #12. If not yet tagged, release v0.2.0 — the on-demand scan endpoint is a new externally-facing feature, warranting a minor version bump per semver.

---

Generated by Claude Code