feat: scan history browser, user-scoped viewer tokens, export fixes, email fixes (v1.6.20)

- Scan history browser (history.js, GET /api/db/sessions, get_sessions(),
  get_session_items(ref_scan_id)) — review any past session without rescanning
- User-scoped viewer tokens (#34) — scope by individual employee across M365
  and GWS; autocomplete from Accounts list; dual-email support
- Fix: GWS scan never marked finished (end_scan → finish_scan) and emitted
  wrong SSE event (scan_done → google_scan_done), excluding GWS items from all
  exports
- Fix: file scan begin_scan called with wrong keyword args (TypeError swallowed),
  so local/SMB items were never written to DB
- Fix: Graph sendMail reported failure on success — _post() now returns {} on
  empty 202 response instead of raising JSONDecodeError
- Fix: Graph error hidden behind generic "No SMTP host" message when both Graph
  and SMTP were unavailable
- Fix: Gmail vs Google Workspace SMTP error messages distinguished by username
  domain; Workspace errors point to admin console, not personal security settings
- Docs: update README, MANUAL-EN, MANUAL-DA, CLAUDE.md, TODO.md, CHANGELOG.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

routes/google_scan.py

@@ -316,13 +316,13 @@ def _run_google_scan(options: dict):
                 broadcast("scan_error", {"file": f"Drive/{user_email}", "error": str(e)})
 
     elapsed = _time.monotonic() - t_start
-    broadcast("scan_done", {
+    broadcast("google_scan_done", {
         "flagged_count":  total_flagged,
         "total_scanned":  total_scanned,
         "elapsed_seconds": round(elapsed, 1),
     })
     if _db and _db_scan_id:
         try:
-            _db.end_scan(_db_scan_id, total_scanned, total_flagged)
+            _db.finish_scan(_db_scan_id, total_scanned)
         except Exception:
             pass