feat: SDK agent integration + UDP plugin framework + SNMP plugin

SDK enhancements for endpoint agent embedding:
- ScanWithController for pause/resume and live stats
- OnProgress callback for periodic progress reporting
- TaskID injection into every scan result
- ScanController with goroutine-safe pause/resume/stats
- Multi-target stats aggregation (race-free)

UDP plugin infrastructure:
- PluginTypeUDP registry with dedicated dispatch path
- DialUDP on ScanSession with rate limiting and packet counting
- UDP plugins bypass TCP port scan, probe targets directly
- FilterService excludes UDP plugins from TCP port matching

SNMP plugin (first UDP plugin):
- SNMPv2c GetRequest probe for sysDescr detection
- Community string brute force (public/private/community/etc)
- Pure stdlib implementation (encoding/asn1)
- Registered as safe default plugin on port 161/UDP

Tests: 95.7% SDK coverage, race-free, 50+ new test cases

common/session.go

@@ -24,6 +24,7 @@ type ScanSession struct {
 	State      *State     // 可变，原子操作，每会话独立
 	Params     *FlagVars  // 原始参数，只读
 	ResultSink ResultSink // 可选，覆盖全局输出
+	PauseGate  func(ctx context.Context) error
 
 	// 每会话 dialer（按 timeout 懒初始化，取决于代理配置）
 	dialerMu   sync.Mutex
@@ -120,6 +121,23 @@ func (s *ScanSession) DialTCP(ctx context.Context, network, address string, time
 	return conn, nil
 }
 
+// DialUDP creates a connected UDP socket with rate limiting and packet counting.
+// UDP cannot be proxied; if a proxy is configured the connection is made directly.
+func (s *ScanSession) DialUDP(ctx context.Context, address string, timeout time.Duration) (net.Conn, error) {
+	if ok, err := CanSendPacketWith(s.Config, s.State); !ok {
+		return nil, fmt.Errorf("%s", i18n.Tr("network_rate_limited", err.Error()))
+	}
+
+	conn, err := net.DialTimeout("udp", address, timeout)
+	if err != nil {
+		s.State.IncrementUDPPacketCount()
+		return nil, err
+	}
+	_ = conn.SetDeadline(time.Now().Add(timeout))
+	s.State.IncrementUDPPacketCount()
+	return conn, nil
+}
+
 // HTTPDo executes an HTTP request with the session's packet limits and counters.
 func (s *ScanSession) HTTPDo(client *http.Client, req *http.Request) (*http.Response, error) {
 	if ok, err := CanSendPacketWith(s.Config, s.State); !ok {