Scan manually added accounts

Manual accounts were never scanned:
- Sidebar "add user" entries had no platform, and getSelectedUsers()
  required platform === 'm365', so they were dropped from every scan.
- Profile-editor manual accounts were stored as "manual:<email>", which
  is not a Graph user id, and applying the profile never put them in the
  sidebar list, so they could not be selected.

Now the editor looks the email up via /api/users/lookup and stores the
directory id plus name/email (falling back to manual:<email> only when the
lookup fails). Applying a profile adds its manual accounts to the sidebar
and resolves legacy manual:<email> entries, logging any that can't be
found. The scan engine resolves remaining manual:<email> ids (e.g. from
scheduled scans) via the new M365Connector.lookup_user(), skipping and
reporting failures without widening to all users.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

m365_connector.py

@@ -224,6 +224,10 @@ class M365Connector:
             return {"displayName": "App (service account)", "id": "", "mail": ""}
         return self._get("/me")
 
+    def lookup_user(self, upn: str) -> dict:
+        """Look up one directory user by UPN or email (requires User.Read.All)."""
+        return self._get(f"/users/{upn}", {"$select": "id,displayName,mail,userPrincipalName"})
+
     def list_users(self, top: int = 999) -> list:
         """List licensed domain users in the tenant (requires User.Read.All).