A11Y Record Scan

Record ONE mechanical a11y code scan: recap + the keys it SAW (Developer+).

The scan itself runs client-side (sonenta a11y scan CLI or the sonenta-a11y agent): it parses usage sites, infers each key's type and persists it through the normal key-update paths with type_source='detected'. But a retype that merely CONFIRMS text writes nothing, so the server could not tell a key the scan had looked at from one it had never opened. seen_key_uuids carries that fact: every uuid in it is stamped type_analyzed_at + type_analyzed_scan_id (task 1827), whatever the type outcome was — including a refused_manual, which IS a key the scan saw.

BATCHING: omit scan_id to open a run (the response carries the minted id), then echo it on each follow-up batch so one run stamps one id; a scan_id that is not the project's current run is a 422. Recap counters are SET, not summed — send the run's full totals on every batch. Idempotent: re-posting a batch stamps the same keys with the same id.

Writes NO translations and no overrides; on keys it writes only the two analysis-marker fields — no updated_at bump, no audit row, so a 16k-key scan does not flood the activity feed. last_run_at is stamped server-side.