[mattmacrocket]

Closes #64.

What

A per-device trusted scanner flag, set from the device detail view. Decoy trips from a trusted scanner are kept as forensic evidence and still count toward the decoy's connection total, but they neither create nor feed Decoy Trip alerts. Credential trips stay Critical regardless of the flag. The flag is independent of trust status.

Sensor

• Schema v13: devices.trusted_scanner INTEGER NOT NULL DEFAULT 0, idempotent _apply_v13 for existing databases.
• GET /devices, GET /devices/{id} return trusted_scanner; PUT /devices/{id} accepts it. Device WebSocket payloads carry it.
• DecoyAlertHandler._is_trusted_scanner reads the flag at event time (not cached), so toggling in the app takes effect on the next connection in either direction. The branch sits after the discovery-probe check and before the credential branch, so credential use never reaches it.

App

• DeviceSummary / DeviceDetail decode trusted_scanner as Bool? so a pre-v13 sensor still decodes; isTrustedScanner is the read surface.
• DeviceUpdateRequest.trustedScanner (trusted_scanner), nil leaves the sensor value unchanged.
• Device detail: Mark as Trusted Scanner / Unmark Trusted Scanner action plus a header badge. All four DeviceSummary reconstructions (presence flips in WSEventProcessor and AppState, save edits, trust changes) carry the flag so none of them clears it.

Deception integrity

Control surface only. Nothing under decoys/ or scouts/ changes; the decoy's response to a trusted device is byte-identical to its response to anyone else, so a compromised trusted device cannot detect that it is trusted.

Tests

Red first, then green:

• TestMigrationV13 (default false on fresh DB; applies to a v12 DB and is idempotent)
• TestTrustedScanner in test_routes_devices.py (list/detail expose it, PUT sets and clears it)
• TestTrustedScanner in test_decoy_alert_handler.py (trip is evidence without an alert and counters still increment; credential use is still Critical; marking a source trusted stops feeding its open alert; untrusted device still alerts)
• Device manager payload carries the flag
• Swift: DeviceSummary decodes with and without the key; updateDevice encodes only trusted_scanner when that is all that changed

test_schema_v12_adds_campaign_table pinned SCHEMA_VERSION == 12; it now asserts the v12 row exists and the version is at least 12.

Full runs: sensor pytest 2539 passed, 6 skipped; ruff check clean; swift test 160 passed across both targets.

Docs

docs/USER_GUIDE.md: new action under Device Detail View, and the Decoy Trip row notes trusted-scanner activity is retained without an alert.