Use kernel neighbor table (ARP/NDP) as a discovery source for static-IP wired devices #507

Problem

Devices with static IPs (no DHCP lease) connected behind a dumb switch can
only be discovered through the bridge FDB. The kernel neighbor table is a
strictly better signal for these hosts: any host the router routes to or from
appears there (MAC -> IP), which is exactly what LuCI shows under
Status -> Overview -> IPv4 neighbors, while FDB entries age out after ~300s
of silence.

Today the agent already collects the ARP table (/proc/net/arp, #377) and
the server receives it in every payload, but buildDevices
(server-go/internal/adapters/live.go) only uses it to fill in the IP of
devices discovered by other means. A MAC that never shows up in wireless,
FDB or leases is never turned into a device.

Related field report: hosts behind an unmanaged switch, static IPs, visible
in LuCI neighbors and LLDP, absent in NetPulse (the immediate trigger there
is #506, but the general static-IP case remains fragile even after that fix:
FDB flapping on idle hosts).

Proposal

Treat neighbor entries as a last-tier discovery source in buildDevices,
after wireless and FDB attribution:

1. For each polled router, take its ARP/NDP MACs not already attributed by
   wireless or FDB rules.
2. Attribute them to that router as cable (or a neutral band), reusing the
   existing reconciliation idea from the FDB rules: gateway ARP sees the
   whole LAN, so satellite-visible MACs keep their more specific attribution
   (satellite FDB/wireless run first and win).
3. Prefer ip neigh show (covers IPv6 NDP and richer states) over
   /proc/net/arp where available; keep the latter as fallback.
4. Ignore entries in failed/incomplete state.

Acceptance

• A static-IP host behind a dumb switch appears as a wired device of the
  router that routes it, with its IP populated, without any DHCP lease.
• Idle hosts whose FDB entries aged out stay visible while their neighbor
  entry is alive.
• No regression in attribution: a wireless client of a satellite is never
  re-attributed to the gateway via ARP.