Recover unfinished scans so their items aren't stranded

get_session_items / get_open_items / latest_scan_id all require
finished_at IS NOT NULL, but the M365 and Google engines return early
on abort (skipping finish_scan) and a process kill mid-scan (deploy,
OOM, crash) never reaches it either. Result on prod: 41/42 scans had
finished_at NULL, so 291 already-saved flagged items were invisible —
the grid showed nothing.

- finalize_orphan_scans(): finalises every finished_at-NULL scan; runs
  once at startup before the scheduler (nothing is scanning at boot, so
  any unfinished scan is dead). Recovers existing stranded items and
  guards against future mid-scan restarts.
- run_scan: finalise the DB scan on the abort early-return too, so a
  stopped scan's items stay visible without waiting for a restart.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scan_engine.py

@@ -1078,6 +1078,14 @@ def run_scan(options: dict):
         if _check_abort():
             # Save checkpoint so scan can be resumed later
             _save_checkpoint(ck_key, scanned_ids, _state.flagged_items, _state.scan_meta)
+            # Finalise the DB scan record so items found before the stop stay
+            # visible — this early return otherwise skips finish_scan below,
+            # stranding them (invisible to get_session_items / get_open_items).
+            if _db and _db_scan_id:
+                try:
+                    _db.finish_scan(_db_scan_id, resumed_count + idx + 1)
+                except Exception as _e:
+                    logger.error("[db] finish_scan (aborted) failed: %s", _e)
             return
         idx += 1
         kind, meta, _ = _work_q.popleft()  # releases this item from the deque immediately