harden long-running scans and simplify CLI output

[CO0KlE1]

What changed

• remove the Web management server and bundled Web UI from the CLI-oriented fork
• harden long-running scan cancellation, adaptive concurrency, ICMP probing, and session cleanup
• replace in-memory result accumulation with disk-backed streaming storage and crash recovery artifacts
• derive default output filenames from the first target while preserving explicit -o values
• precompile and reuse POC CEL programs and search regular expressions across targets
• add read-only exposure checks for Spring Boot Actuator, Nacos namespaces, XXL-JOB executor groups, and Spring Boot Admin instances
• remove the unfinished fscan-lab application, its separate React UI, lab credentials, generated performance artifacts, a stale backup source file, and obsolete agent instructions
• keep performance test generators while ignoring their regenerated result directory
• update tests, documentation, release workflows, and cross-platform build configuration

Why

Large scans could appear to stall when nested concurrency, resource exhaustion, late plugin results, and unbounded in-memory result collection interacted. Web POC execution also rebuilt identical CEL programs for every target. The repository additionally carried an unfinished standalone lab application and generated benchmark outputs that were not part of the scanner build.

This change gives scan work a bounded lifecycle, moves result retention to disk, prepares reusable POC execution plans at load time, adds focused middleware coverage without turning fscan into a heavyweight vulnerability scanner, and leaves the repository focused on the CLI scanner and its maintained tests and examples.

Impact

• lower and more predictable memory use during long scans
• faster Web POC evaluation across many targets
• more reliable cancellation and output finalization
• CLI-only distribution without the Web management or lab UI surfaces
• smaller and cleaner source tree without generated benchmark output or test credentials
• middleware checks use fingerprint gates and read-only list or HEAD requests
• no command execution, file download, state-changing login, job trigger, or denial-of-service request in the newly added checks

Validation

Earlier hardening validation:

• go test ./... -count=1 -timeout=15m
• go vet ./...
• golangci-lint v2.12.1 (0 issues)
• Windows/amd64 build
• Linux/amd64 build

Latest middleware and cleanup validation:

• go build ./...
• go test ./webscan -run TestEmbeddedPocsArePreparedAtLoadTime -count=1 -timeout=3m
• all 391 embedded POCs loaded and prepared successfully
• repository diff whitespace check

[ZacharyZcR]

Let me take a look. THX.

[ZacharyZcR]

感谢 PR，这个方向整体是不错的，尤其是长时间扫描、取消逻辑、输出落盘和 POC 预编译这些部分，思路我认可。

不过 Web 端这部分先不要全部删除。fscan-web / Web 管理端既然已经发布了，我后续会继续维护和更新。目前也有一部分用户仍然在使用它，所以希望保留 Web 端代码。可以把它维持在额外目录里，和 CLI 主流程隔离即可；CLI 版本本身不会受到 Web 端影响。

除了“完全移除 Web 端”这一点之外，其他改动目前看没有明显问题。你这边如果开发完成、准备审核，随时可以把 Draft 转成正式 PR，我会继续 review。

---

Thanks for the PR. Overall, I like the direction, especially the hardening around long-running scans, cancellation, disk-backed output, and POC precompilation.

However, please do not remove the Web side entirely for now. Since fscan-web / the Web management UI has already been released, I will continue maintaining and updating it. Some users are still using it as well, so I would prefer to keep the Web code in the repository. It can stay isolated in a separate directory so it does not affect the CLI path. The CLI version should not be impacted by the Web UI existing in the repo.

Other than the complete removal of the Web side, the rest of the changes look generally fine to me. Once you finish the work and want a full review, feel free to mark the PR as ready for review.