Persist per-host scan results and expose hosts endpoint.

Store checked hosts for each scan and add API to fetch host-level up/down probe results.

Made-with: Cursor

internal/api/handler.go

@@ -25,6 +25,7 @@ func (h *Handler) Routes() http.Handler {
 	mux.HandleFunc("POST /api/scans", h.createScan)
 	mux.HandleFunc("GET /api/scans", h.listScans)
 	mux.HandleFunc("GET /api/scans/{id}", h.getScan)
+	mux.HandleFunc("GET /api/scans/{id}/hosts", h.getScanHosts)
 	return withJSON(mux)
 }
 
@@ -94,6 +95,32 @@ func (h *Handler) getScan(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, job)
 }
 
+func (h *Handler) getScanHosts(w http.ResponseWriter, r *http.Request) {
+	id := r.PathValue("id")
+	if id == "" {
+		writeError(w, http.StatusBadRequest, "scan id is required")
+		return
+	}
+	if _, ok := h.store.GetScan(id); !ok {
+		writeError(w, http.StatusNotFound, "scan not found")
+		return
+	}
+
+	limit := 500
+	if raw := r.URL.Query().Get("limit"); raw != "" {
+		n, err := strconv.Atoi(raw)
+		if err != nil || n <= 0 || n > 5000 {
+			writeError(w, http.StatusBadRequest, "limit must be between 1 and 5000")
+			return
+		}
+		limit = n
+	}
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"items": h.store.ListHostResults(id, limit),
+	})
+}
+
 func withJSON(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json; charset=utf-8")