Improve active device discovery, ISP lookup, and identity persistence

[Boussetta]

Summary

• Fix Windows neighbor-state filtering: exclude Stale/Permanent cache entries so disconnected devices don't linger indefinitely.
• Add active IPv4 ARP-based discovery (bounded, rotating /24 sweep) so idle devices that don't appear in the passive ARP/NDP cache can still be found.
• Add a persistent MAC-keyed XML device metadata store (XmlLite-based) so device identity, vendor, hostname, and device type survive across restarts.
• Fix an infinite-loop hang in the XML reader that could block tray icon creation entirely.
• Add device-type icons on the network map (paired with the existing Wi-Fi/Ethernet icon), and remove redundant type/vendor text.
• Add ISP discovery: public IP, ASN, org name, city/region/country, postal code, timezone, and coordinates (WinHTTP HTTPS lookup, background thread, 1h refresh).
• Show ISP details (expandable) when clicking the Internet node on the map.
• Fix: join/leave notifications never included a device name (only IP/MAC) - now shows label/hostname.
• Fix: device store never restored a previously learned hostname/vendor when a poll's live DNS resolution came back empty, and discovery events used for notifications bypassed store enrichment entirely.

Validation

• MSVC Debug build succeeds for all targets.
• All 6 CTest tests pass.
• Verified at runtime: active discovery finds a previously-invisible phone, ISP lookup returns all fields, notifications include the correct device name for a known MAC.

[Copilot]

🟡 Changes recommended

There are confirmed shutdown and active-probe thread-lifetime hazards that can lead to use-after-free/stack-use-after-scope in normal execution paths.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR enhances LinkPulse’s Windows network discovery and UI by combining passive neighbor snapshots with bounded active ARP probing, persisting device identity metadata across restarts, and adding background ISP/public-IP enrichment that is displayed on the network map and used for more informative notifications.

Changes:

• Add bounded active IPv4 ARP probing and improve neighbor-state filtering so disconnected devices don’t linger and idle devices can still be found.
• Introduce a persistent MAC-keyed XML device metadata store (XmlLite) and apply it to both map rendering and join/leave notifications.
• Add background ISP lookup (WinHTTP) and expandable ISP details in the network map UI, plus device-type icons.

File summaries

File	Description
src/ui/tray_win32.c	Starts ISP/device-store workflows, enriches discovery events, and wires new shutdown behavior.
src/ui/network_map_win32.c	Adds device-type glyphs and expandable ISP detail rendering in the map UI.
src/platform/win32/isp_win32.c	Implements WinHTTP-based ISP/public-IP lookup.
src/platform/win32/discovery_win32.c	Improves neighbor filtering and adds bounded active ARP probing.
src/platform/win32/device_store_win32.c	Implements XmlLite-backed persisted device metadata store.
include/linkpulse/isp.h	Adds the ISP info data model + lookup API.
include/linkpulse/discovery.h	Extends neighbor/network structs to carry persisted identity + ISP info.
include/linkpulse/device_store.h	Declares the Win32 device store API.
CMakeLists.txt	Adds new Win32 sources and links XmlLite/Shlwapi.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.