Scan manually added accounts

Manual accounts were never scanned:
- Sidebar "add user" entries had no platform, and getSelectedUsers()
  required platform === 'm365', so they were dropped from every scan.
- Profile-editor manual accounts were stored as "manual:<email>", which
  is not a Graph user id, and applying the profile never put them in the
  sidebar list, so they could not be selected.

Now the editor looks the email up via /api/users/lookup and stores the
directory id plus name/email (falling back to manual:<email> only when the
lookup fails). Applying a profile adds its manual accounts to the sidebar
and resolves legacy manual:<email> entries, logging any that can't be
found. The scan engine resolves remaining manual:<email> ids (e.g. from
scheduled scans) via the new M365Connector.lookup_user(), skipping and
reporting failures without widening to all users.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

static/js/users.js

@@ -28,6 +28,7 @@ async function loadUsers() {
       u.selected = prevSelected.has(u.id) ? prevSelected.get(u.id) : false;
     });
     S._allUsers = [...fetched, ...toAdd];
+    S._m365UsersLoaded = true;
     // Apply deferred "select all" from a profile chosen before users loaded
     if (window._pendingProfileAllUsers) {
       S._allUsers.forEach(u => { u.selected = true; });
@@ -421,7 +422,7 @@ async function addUserManually() {
     const d = await r.json();
     if (d.error) { alert('User not found: ' + d.error); return; }
     if (S._allUsers.find(u => u.id === d.id)) { alert('User already in list.'); return; }
-    S._allUsers.push({...d, manual: true});
+    S._allUsers.push({...d, platform: 'm365', manual: true});
     input.value = '';
     renderAccountList(S._allUsers.filter(u => !u.manual).length <= 1);
   } catch(e) {
@@ -447,16 +448,18 @@ function selectAllAccounts(checked) {
 
 function getSelectedUsers() {
   // Only return M365 users — Google users are handled separately via selectedGoogleEmails
-  let selected = S._allUsers.filter(u => u.selected !== false && (u.platform === 'm365' || u.platform === 'both'));
+  // Manually added users may have no platform — they are M365 lookups, so treat missing as 'm365'
+  let selected = S._allUsers.filter(u => u.selected !== false && ['m365', 'both'].includes(u.platform || 'm365'));
   // Respect the active role filter — hidden users must not sneak into the scan
   // even if they were checked before the filter was applied.
   if (_activeRoleFilter) {
     selected = selected.filter(u => (u.userRole || 'other') === _activeRoleFilter);
   }
   if (selected.length) {
-    return selected.map(u => ({
-      id: u.id, displayName: u.displayName, userRole: u.userRole || 'other'
-    }));
+    // manual/email let a profile saved from this selection re-add manual users on apply
+    return selected.map(u => Object.assign(
+      { id: u.id, displayName: u.displayName, userRole: u.userRole || 'other' },
+      u.manual ? { manual: true, email: u.email || '' } : {}));
   }
   // Fallback to DOM if S._allUsers not yet populated
   return Array.from(document.querySelectorAll('.account-check:checked')).map(cb => ({