docs(scanner): Beam batch 7 — all 10 scanner endpoints backfilled

Scanner surface frontmatter'd (scan/start/stop/cancel/status/active/
active-summary + watch start/stop/status) with provenance comments;
active-summary on a non-admin group.

Claude registry: 10 entries. Fixed handler drift Beam missed: scan_library
request has no "recursive"; scanner/start binds folder_paths (not
invented interval_seconds); scanner/stop binds no body; response is
{message, job_id, status} with 409 coalescing variant
{error, active_job_id}.

Gate fix in drift_test seed: registerScannerRoutes group seeds used bare
"jwt"/"admin" tokens invisible to authLabel; and silently passed before
only because the seeded set was unchecked. Seeds now 'jwtMiddleware'/
'AdminMiddleware' markers. Also: cleanup of a stale-merge-script residue
in collections/update_rule.md example (extra null keys). make test 9/9.

docs/developer/api/scanner/cancel_scan.md

@@ -0,0 +1,36 @@
+---
+method: POST
+path: /api/scanner/cancel/:jobId
+auth: jwt+admin
+area: scanner
+---
+<!-- source: internal/handlers/scanner.go:236 Handler.CancelScan -->
+
+# Cancel Scan
+
+Requests cancellation of a pending or running scan job. Cancellation is
+cooperative — the file currently being processed finishes, the walk stops
+at its next context check, and the archive pass is skipped.
+
+## Example response
+
+```json example-response
+{
+  "message": "scan cancellation requested",
+  "job_id": "job-uuid",
+  "status": "cancelled"
+}
+```
+
+## Path parameters
+
+| Param | Type | Required | Notes |
+| ----- | ---- | -------- | ----- |
+| jobId | string | Yes | Scan job id |
+
+## Errors
+
+| Status | Body | When |
+| ------ | ---- | ---- |
+| 404 | `{"error": "job not found"}` | no such job |
+| 409 | `{"error": "..."}` | job cannot be cancelled |