itdove/ai-guardian#1166: feat: interactive file/directory scan with Allow Always from web console and TUI

[itdove]

Jira Issue: #1166

Description

Add interactive file/directory scanning with "Allow Always" functionality from both the web console and TUI.

Key changes:

• Directory scan endpoint & UI — New REST API endpoint for directory scanning (rest_api.py, scanner.py), with corresponding web page (web/pages/directory_scan.py) and TUI screen (tui/directory_scan.py) for interactive scan initiation and result display.
• Violation rescan & allowlist — New violation_rescan.py module enabling rescan of violations and one-click allowlisting directly from the violations view. Both web (web/pages/violations.py) and TUI (tui/violations.py) updated with "Allow Always" buttons in violation detail modals.
• Multi-client support — Updated multi_client.py to support the new scan and rescan flows.
• Daemon service integration — Extended web/services/daemon_service.py to wire up new endpoints.
• Tests — Added test_scan_endpoint.py for directory scan API and test_violation_rescan.py for rescan/allowlist logic, using pytest tmp_path fixtures.

Assisted-by: Claude

Testing

Steps to test

1. Pull down the PR
2. Start the daemon: ai-guardian daemon start
3. Web console — directory scan: Open the web console, navigate to the Directory Scan page, select a directory, run a scan, and verify results display correctly
4. Web console — Allow Always: Go to Violations, click a violation to open the detail modal, click "Allow Always", and confirm the pattern is added to the allowlist
5. TUI — directory scan: Launch the TUI (ai-guardian tui), navigate to Directory Scan, run a scan, verify results
6. TUI — Allow Always: In the TUI Violations view, select a violation, open the detail modal, click "Allow Always", confirm allowlist update
7. Rescan: After allowlisting a violation, trigger a rescan and verify the violation no longer appears
8. Run unit tests: pytest tests/unit/test_scan_endpoint.py tests/unit/test_violation_rescan.py -v

Scenarios tested

• Directory scan returns findings for a directory with known secrets/PII
• Directory scan on a clean directory returns no findings
• "Allow Always" adds the correct pattern to the allowlist config
• Rescan after allowlisting correctly filters out the allowed pattern
• API endpoint returns proper error responses for invalid paths

Deployment considerations

• This code change is ready for deployment on its own
• This code change requires the following considerations before being deployed: