feat: Binärdateien auf Änderungen prüfen (check-assets / approve-assets)

Neue Befehle:
- `python -m scanner check-assets`    — SHA-256-Hashes aller JS/CSS/Bild-Assets
  aus dem letzten Snapshot fetchen und mit Baseline vergleichen
- `python -m scanner approve-assets`  — aktuelle Hashes als neue Baseline setzen

Scoring: geändertes JS 40 Pkt, CSS 30 Pkt, Bild/PDF 20 Pkt.
Asset-Baseline liegt in data/baseline/asset_hashes.json.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scanner/baseline.py

@@ -211,6 +211,28 @@ class BaselineManager:
         self.pages_dir.mkdir(parents=True, exist_ok=True)
         return self.approve_all(snap_dir=snap_dir, note=note, approved_by=approved_by)
 
+    # ------------------------------------------------------------------
+    # Asset hash baseline
+    # ------------------------------------------------------------------
+
+    @property
+    def _asset_hashes_path(self) -> Path:
+        return self.baseline_dir / "asset_hashes.json"
+
+    def load_asset_hashes(self) -> dict:
+        """Load approved asset hashes. Returns {} if none approved yet."""
+        if not self._asset_hashes_path.exists():
+            return {}
+        return json.loads(self._asset_hashes_path.read_text(encoding="utf-8"))
+
+    def save_asset_hashes(self, hashes: dict) -> None:
+        """Persist asset hashes as the new approved state."""
+        self.baseline_dir.mkdir(parents=True, exist_ok=True)
+        self._asset_hashes_path.write_text(
+            json.dumps(hashes, indent=2, ensure_ascii=False), encoding="utf-8"
+        )
+        logger.info("Asset hashes saved: %d entries", len(hashes))
+
     # ------------------------------------------------------------------
     # Internal helpers
     # ------------------------------------------------------------------