feat: add soft scan mode (slow ICMP) to avoid switch/AP rate-limiting

Reduces ICMP concurrency from 100 to 10 workers when soft_scan=true,
spreading out probes to avoid rate-limiting on managed switches and APs.
The option is hidden in the UI when TCP check is active (redundant).

Update README (en/fr/es), docs/backend.md with the new scan modes table
and a troubleshooting entry for ICMP rate-limiting.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/components/DiscoveryModal.vue

@@ -63,6 +63,14 @@
             <div class="input-hint">{{ t('tcpCheckHint') }}</div>
           </div>
 
+          <div v-if="!tcpCheck" class="field field-toggle">
+            <label class="toggle-row">
+              <input type="checkbox" v-model="softScan" class="toggle-checkbox" />
+              <span class="toggle-label">{{ t('softScanLabel') }}</span>
+            </label>
+            <div class="input-hint">{{ t('softScanHint') }}</div>
+          </div>
+
           <div v-if="configError" class="error-box">{{ configError }}</div>
         </div>
 
@@ -186,6 +194,7 @@ const emit = defineEmits(['close', 'refresh'])
 const step           = ref('config')
 const dnsServer      = ref('')
 const tcpCheck       = ref(false)
+const softScan       = ref(false)
 const selectedVlanIds = ref([])
 const results        = ref([])
 const selectedIps    = ref([])
@@ -272,6 +281,7 @@ async function startScan() {
       dns_server: dnsServer.value.trim(),
       targets,
       tcp_check: tcpCheck.value,
+      soft_scan: softScan.value,
     })
     results.value = resp.data.hosts
     scanMeta.value = { total_scanned: resp.data.total_scanned, duration_s: resp.data.duration_s }

frontend/src/i18n.js

@@ -130,6 +130,8 @@ const LANGS = {
     scanNote: 'Chaque hôte est pingé puis interrogé en DNS.',
     tcpCheckLabel: 'Scan TCP (anti proxy-ARP)',
     tcpCheckHint: 'Utilise TCP au lieu de ICMP pour détecter les hôtes actifs (ports 22, 80, 443, 8080, 8443). Élimine les faux positifs proxy-ARP (UniFi…) et détecte les équipements dont le ping ICMP est bridé sous charge. Peut rater les équipements qui bloquent silencieusement (DROP) tous ces ports.',
+    softScanLabel: 'Scan doux (ICMP lent)',
+    softScanHint: 'Réduit la concurrence ICMP de 100 à 10 workers pour éviter le rate-limiting des switchs et AP. Le scan prend plus de temps mais manque moins d'équipements.',
     hostsFound: 'hôte(s) découvert(s)',
     addressesScanned: 'adresses scannées',
     newHosts: 'nouveaux',
@@ -289,6 +291,8 @@ const LANGS = {
     scanNote: 'Each host is pinged then queried via DNS.',
     tcpCheckLabel: 'TCP scan (anti proxy-ARP)',
     tcpCheckHint: 'Uses TCP instead of ICMP to detect live hosts (ports 22, 80, 443, 8080, 8443). Eliminates proxy-ARP false positives (UniFi…) and detects hosts whose ICMP is rate-limited under load. May miss devices that silently block (DROP) all probed ports.',
+    softScanLabel: 'Soft scan (slow ICMP)',
+    softScanHint: 'Reduces ICMP concurrency from 100 to 10 workers to avoid rate-limiting by switches and APs. The scan takes longer but misses fewer devices.',
     hostsFound: 'host(s) found',
     addressesScanned: 'addresses scanned',
     newHosts: 'new',
@@ -447,6 +451,8 @@ const LANGS = {
     scanNote: 'Cada host es pingado y luego consultado en DNS.',
     tcpCheckLabel: 'Escaneo TCP (anti proxy-ARP)',
     tcpCheckHint: 'Usa TCP en lugar de ICMP para detectar hosts activos (puertos 22, 80, 443, 8080, 8443). Elimina falsos positivos de proxy-ARP (UniFi…) y detecta hosts con ICMP limitado bajo carga. Puede omitir equipos que bloqueen silenciosamente (DROP) todos los puertos sondeados.',
+    softScanLabel: 'Escaneo suave (ICMP lento)',
+    softScanHint: 'Reduce la concurrencia ICMP de 100 a 10 workers para evitar el rate-limiting de switches y APs. El escaneo tarda más pero detecta más equipos.',
     hostsFound: 'host(s) descubierto(s)',
     addressesScanned: 'direcciones escaneadas',
     newHosts: 'nuevos',