fix: resolve all 23 MAINTENANCE audit tickets

- deps guards before -h|--help in docker-health/ps, network-scan,
  usb-server, media-mp3/mp4 (--dry-run pre-scan kept); system-firewall
  gains usage()/--help; autostart/usb-automount get flags.sh + template
- install.sh: normalize N-M range syntax in --steps
- bin/pos: INTERACTIVE_CMDS += docker-compose docker-vbox network-hotspot
- common.sh: canonical XDG-aware CONFIG_DIR + DIM color var; notify.sh
  stderr fallback; ent_plugin_* registry renames (runtime plugin API kept)
- docker-compose SCALE_DIR/CONFIG_ENV env seams; ffmpeg in PACKAGES;
  scrcpy.sh exec bit
- docs: health is console-only (--send/--markdown removed), POS.md file
  refs for config/tree/entertainment, DEV.md no-guard exception, docmap/
  filetable regenerated (make gen), hand-maintained line rows bumped
- add scripts/lint-conventions.sh gate + Makefile lint target; record
  all VERIFIED outcomes in MAINTENANCE.md; AGENT_TODO Done entry
  (2026-08-14)
- gates: make gen/check/lint all green (0 FAIL, 0 WARN); bash -n sweep
  clean; restricted-PATH dep tests + step-matrix dry-runs verified

bin/pos-network-scan

@@ -24,6 +24,12 @@ EOF
     exit 0
 }
 
+# Deps guard before -h|--help (help also errors without nmap).
+if ! command -v nmap &>/dev/null; then
+    echo "ERROR: nmap is required. Install with: sudo apt install nmap"
+    exit 1
+fi
+
 case "${1:-}" in
     -h|--help|"") usage ;;
 esac
@@ -63,11 +69,6 @@ else
     exit 1
 fi
 
-if ! command -v nmap &>/dev/null; then
-    echo "ERROR: nmap is required. Install with: sudo apt install nmap"
-    exit 1
-fi
-
 # ── Estimate host count ────────────────────────────────────────
 cidr_bits="${net##*/}"
 if [[ "$cidr_bits" -ge 24 ]]; then