v0.2.0

feat: authorized LAN scanning — arp, netscan, portscan, device (v0.2.0)

New commands (TCP-connect only, no root, gated behind an explicit
authorization acknowledgement):

- arp: system ARP/neighbor table (macOS/Linux/Windows parsers) with
  embedded OUI vendor lookup; read-only, no acknowledgement needed
- netscan <CIDR>: subnet device discovery via concurrent TCP sweep
  correlated with the ARP table (via: tcp/arp)
- portscan <TARGET>: TCP connect scan with common/list/range port specs
- device <IP>: per-device analysis — MAC vendor, reverse-DNS hostname,
  open ports, HTTP(S) fingerprint (Server header, <title>) and an
  informational device-type guess

Authorization model: CLI flag --yes-i-have-permission or env
NETON_I_HAVE_PERMISSION=yes (exit code 2 without it); serve mode only
exposes the scan actions when started with the same acknowledgement and
answers HTTP 403 otherwise. /invoke-actions lists all 11 actions.

Also fixes two latent bugs caught by tests: the minimal DNS client
rejected every response (inverted QR-bit check) and sent a malformed
11-byte header; and MAC normalization dropped macOS `arp` output where
leading zeros are omitted per group.