On-demand scan

Trigger an unscheduled scan for a specific domain. The job is enqueued through the normal worker pipeline and is fully audit-logged. Use sparingly.