Bizni: scan public websites of businesses for security/email issues (lead opportunities)

Imported from GitHub issue El-SaMa/oma#206 by @El-SaMa.

---

Phase 2 of the Lanetti Tools plan. Leads must come from public website data of businesses in Bizni, never from who used a tool (purpose limitation: tool data is for improving the tools only).

Do:

• Worker/cron that scans bizni_businesses.website in small rate-limited batches with the existing LaneDNS APIs (via services/core-api/src/lanetti-tools/client.ts): Arx Site Check (/api/site-check.php), email health, SSL, security headers, blocklist.
• Store a compact summary in bizni_businesses.website_insights (score, flags like malware/old_wp/weak_headers/no_dmarc/cert_expiring, scanned_at).
• Feed /admin/bizni/opportunities with filters by problem type; staff MCP action for the list.
• Respect robots and site load: one scan per site per 30 days, max N per hour.
• Later campaign: company addresses only, easy opt-out, wording checked once before sending (draft-before-send rule).

Context (2026-10-14): lanedns.lanetti.fi (Lanetti Tools, standalone PHP site on nilek, repo El-SaMa/lanedns site/) was revamped and OMA became its control plane: usage in /admin/tools/usage, settings in /admin/tools/settings, staff MCP oma.admin_lanetti_tools, config pull GET /api/lanetti-tools/config (link token in LaneDNS storage/oma-link.php). Events: site_events site lanedns.lanetti.fi, tool_run sanitized by services/core-api/src/lanetti-tools/usage-events.ts. Read handbook hosting/netspeed section "OMA is the control plane" and .cursor/rules/lanedns-standalone.mdc (deploy recipe: keep public_html group www-data) before touching LaneDNS.