Trust directly-scanned mgmt IP over neighbor-reported LLDP value

Some vendors (e.g. HP/Aruba ProCurve) advertise a per-port Management
Address TLV that reflects whatever VLAN is routable out that link,
not the switch's real management IP. A neighbor's LLDP report could
therefore overwrite a switch's correct mgmt_ip with a wrong one.
upsert_switch() now takes a trusted flag: a direct scan's mgmt_ip
always wins, while a neighbor-reported one only fills in a blank
value.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scanner.py

@@ -105,6 +105,7 @@ def run_scan(dept: str = None, workers: int = 5, login_delay: int = 3):
                 firmware=result.get("firmware", ""),
                 vendor=result.get("vendor", ""),
                 serial=result.get("serial", ""),
+                trusted=True,
             )
 
             for neighbor in result["neighbors"]: