Recover unfinished scans so their items aren't stranded

get_session_items / get_open_items / latest_scan_id all require
finished_at IS NOT NULL, but the M365 and Google engines return early
on abort (skipping finish_scan) and a process kill mid-scan (deploy,
OOM, crash) never reaches it either. Result on prod: 41/42 scans had
finished_at NULL, so 291 already-saved flagged items were invisible —
the grid showed nothing.

- finalize_orphan_scans(): finalises every finished_at-NULL scan; runs
  once at startup before the scheduler (nothing is scanning at boot, so
  any unfinished scan is dead). Recovers existing stranded items and
  guards against future mid-scan restarts.
- run_scan: finalise the DB scan on the abort early-return too, so a
  stopped scan's items stay visible without waiting for a restart.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

gdpr_scanner.py

@@ -2305,6 +2305,19 @@ Example --settings file with SMTP:
         print(f"\n  GDPRScanner\n  ──────────────────────────────")
         print(f"  Open: http://{args.host}:{args.port}")
 
+        # Recover scans left unfinished by a crash / kill / mid-scan restart.
+        # Nothing is scanning at startup, so any scan with finished_at IS NULL is
+        # dead; finalising it makes its already-saved items visible again instead
+        # of stranding them (both get_session_items and get_open_items require a
+        # finished scan). Must run before the scheduler can start a new scan.
+        try:
+            if DB_OK:
+                _recovered = _get_db().finalize_orphan_scans()
+                if _recovered:
+                    print(f"  Recovered {_recovered} unfinished scan(s) from a prior restart")
+        except Exception as _orphan_err:
+            print(f"  Orphan-scan recovery: failed ({_orphan_err})")
+
         # Start in-process scheduler (#19)
         try:
             import scan_scheduler as _sched_mod