refactor: consolidate scanning logic into Engine API

Add engine module with Engine enum (Bpf/ConnectOnly) that owns BPF
state and provides discover() + collect_timing() methods. This
consolidates scanning logic previously duplicated across CLI and
consumer into a single API.

- Engine::new() handles BPF init with ConnectOnly fallback
- Engine::discover() does port expansion, max_ports truncation,
  early-return BPF polling, and connect-scan fallback
- Engine::collect_timing() delegates to collect_timing_samples_raw
- resolve_target() moved from cli to engine module
- Added max_ports field to ScanRequest
- Added set_profile() to SynScanner for per-request pacing
- CLI run_scan/run_time now delegate to Engine (~195 lines removed)

Author: Simon Morley