bucket discovery engine: CT domain -> candidate names -> listing index

CMS SANs are custom domains, not bucket names, so matching SANs finds almost
no buckets. This adds internal/discover: from each non-matching hostname it
derives candidate names (domain label + subdomain label + ~40 suffixes) plus a
built-in wordlist, and anonymously tests listing on S3, GCS and (optionally)
DigitalOcean Spaces. Every 200 is indexed (keys/sizes/dates only).

Bounded hard: global BUCKET_SCAN_QPS rate limit, 12h per-name dedup, random
sampled domain queue, MaxPerDomain cap. Never downloads contents.

Fix: GCS candidates now use the virtual-host form
(<bucket>.storage.googleapis.com) so buckets no longer collide on the
cloud_assets unique key; previously they all shared storage.googleapis.com and
overwrote each other.

Live: 30 open buckets in ~5 min (e.g. estimator-dev, image-prod,
update-media, mos-images S3; several GCS buckets), 11k+ objects indexed.

internal/model/model.go

@@ -126,6 +126,7 @@ const (
 	SourceCNAME
 	SourceDNSAlias
 	SourceManual
+	SourceDiscovery
 )
 
 func (s Source) String() string {
@@ -138,6 +139,8 @@ func (s Source) String() string {
 		return "dns_alias"
 	case SourceManual:
 		return "manual"
+	case SourceDiscovery:
+		return "discovery"
 	default:
 		return "unknown"
 	}