Add Monitored

Watch an address (idempotent upsert on (key, chain, address)).

W1 — Watch is a loop, not a list: on watch-create we kick off a one-shot INITIAL exposure scan (run_initial_watch_scan, as a BackgroundTask so the response stays fast) that checks the address against the CURRENT sanctions ∪ mixer sets and emits a retroactive_alert (+ signed webhook if a URL was given) for any existing exposure — so a hit lands immediately, not only when a NEW designation is published. The scheduled scanners then keep it current against newly-designated addresses each cycle.