Audit and stabilize PortScanner project

[nsergej]

Summary

This PR audits and stabilizes the PortScanner Delphi/VCL project for safer publication on GitHub. It fixes confirmed scanner lifecycle, networking, export, build, UI, and repository documentation issues while preserving the current product scope: TCP scanning of one numeric IPv4 address.

Critical / High Issues Found

• Worker threads were started before their fields were initialized.
• Worker objects used FreeOnTerminate=True while the form still stored pointers to them.
• Closing the form during a scan could free the queue, critical section, results, and WinSock before workers finished.
• The repository could not be built from a clean clone because PortScanner.dpr referenced a missing generated .res file.

Source Code Fixes

• Created workers suspended, initialized all fields, then started them explicitly.
• Made the form own worker thread objects and wait for completion during shutdown.
• Protected cancellation and queue access with the existing critical section.
• Reduced UI synchronization by batching closed-port progress updates.
• Avoided full result-list rebuilds on every open-port update.
• Added strict numeric IPv4 validation.
• Checked getsockopt(..., SO_ERROR, ...) before reporting TCP ports as open.
• Switched response timing to GetTickCount64.
• Added WinInet timeouts, response accumulation, size limiting, and IPv4 validation for the external IP button.
• Added HTML escaping, CSV escaping, and Delphi JSON serialization.
• Exported reports to %USERPROFILE%\Documents\PortScanner Reports instead of the executable directory.
• Fixed UI text: Address and Open Ports.

Performance Changes

• Kept the bounded worker pool.
• Removed per-port UI synchronization for closed-port progress in favor of batched updates.
• Updated the result list incrementally instead of clearing and rebuilding it for every open port.

Documentation Changes

• Rewrote README.md around actual behavior and limitations.
• Added BUILDING.md, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, CHANGELOG.md.
• Added docs/USAGE.md, docs/ARCHITECTURE.md, docs/TEST_PLAN.md.
• Documented IPv4-only and TCP-only behavior.
• Documented the optional external IP service call.
• Documented the missing .dproj state and the PortScanner.rc resource source.

Added Files

• src/PortScanner.rc
• BUILDING.md
• CONTRIBUTING.md
• SECURITY.md
• CODE_OF_CONDUCT.md
• CHANGELOG.md
• docs/USAGE.md
• docs/ARCHITECTURE.md
• docs/TEST_PLAN.md
• .github/PULL_REQUEST_TEMPLATE.md
• .github/ISSUE_TEMPLATE/bug_report.md
• .github/ISSUE_TEMPLATE/feature_request.md
• .github/workflows/repository-checks.yml

Renamed Files

• docs/sample_repor.csv -> docs/sample_report.csv
• docs/sample_repor.html -> docs/sample_report.html
• docs/sample_repor.json -> docs/sample_report.json

Validation

• Built Win32 with Delphi 10.4 dcc32.
• Built Win64 with Delphi 10.4 dcc64.
• Ran git diff --check main..HEAD.
• Verified README sample values match docs/sample_report.*.
• Parsed CSV and JSON samples.
• Checked HTML sample contains matching result rows.
• Checked local Markdown links.
• Checked external Markdown links returned HTTP 200.
• Checked for generated binary/build artifacts in the working tree.
• Searched for common secret/token/key patterns; only documentation wording matched.
• Confirmed the working tree was clean before push.

Not Verified

• Interactive GUI scenarios were documented in docs/TEST_PLAN.md but not manually clicked through in this run.
• No .dproj was generated, because a validated IDE-generated project file was not available.

Risks

• The main scanner code is still in one VCL unit. docs/ARCHITECTURE.md documents the current boundaries and a future split path.
• Report location changed from the executable directory to the user's Documents folder to avoid protected-directory write failures.
• GitHub has both v1.0 and V1.0 tags. This PR documents current behavior but does not delete tags.

Manual Delphi Test Plan

See docs/TEST_PLAN.md for localhost, known-open-port, closed-port, full authorized range, stop, repeat run, close-during-scan, invalid input, export, write-permission, and external-IP-service scenarios.