refactor: run discovery sources with TaskGroup (#2544)

* refactor: run discovery sources with TaskGroup

* fix: preserve source runner compatibility diagnostics

* feat: add configurable source workers

docs/wiki/How-to-add-a-new-module.md

@@ -27,13 +27,7 @@ Do not return fields the provider did not supply. Normalize and deduplicate befo
 
 ## 3. Register the source
 
-Update the current symbols rather than following fixed line numbers:
-
-1. Import the adapter in [`theHarvester/__main__.py`](https://github.com/laramies/theHarvester/blob/dev/theHarvester/__main__.py).
-2. Add its source handler to the existing alphabetical source-selection chain.
-3. Call the central `store()` helper once with only the result flags the adapter supports.
-4. Add the source identifier to `Core.get_supportedengines()` in [`theHarvester/lib/core.py`](https://github.com/laramies/theHarvester/blob/dev/theHarvester/lib/core.py).
-5. Add the identifier to the CLI `--source` help list.
+Add one catalog entry in [`theHarvester/lib/source_catalog.py`](https://github.com/laramies/theHarvester/blob/dev/theHarvester/lib/source_catalog.py) and one factory entry in [`theHarvester/lib/source_runner.py`](https://github.com/laramies/theHarvester/blob/dev/theHarvester/lib/source_runner.py). The catalog supplies CLI help, source selection, and activity classification; the factory constructs the adapter; the runner collects declared result routes and persists them through the existing completed-result flow.
 
 Keep the public source identifier stable and use the same spelling everywhere.
 
@@ -64,6 +58,6 @@ Tests must not require external network access or real provider credentials.
 
 ## 6. Update operator documentation
 
-Add the source to the README source/result matrix with its actual output columns and key requirement. The matrix contract test checks that documented result types match the flags passed to `store()`.
+Add the source to the README source/result matrix with its actual output columns and key requirement. The matrix contract test checks that documented result types match the catalog entry.
 
 In the pull request, link the provider API documentation and explain any intentional exception to shared transport behavior.

docs/wiki/Rest-API.md

@@ -66,6 +66,7 @@ run_id="$(curl -s http://127.0.0.1:5000/api/v1/runs \
       "target": "example.com",
       "sources": ["emails", "crtsh"],
       "limit": 500,
+      "source_workers": 6,
       "deadline_seconds": 1800
     }' \
   | jq -r '.run_id')"
@@ -77,6 +78,9 @@ curl -s "http://127.0.0.1:5000/api/v1/runs/$run_id" \
 
 Run submission is asynchronous. Lifecycle status is `queued`, `running`, `cancelling`, `cancelled`, `completed`, or `failed`. Terminal evidence status is reported separately as `complete`, `partial`, or `failed` when evidence exists.
 
+`source_workers` is the same positive concurrency used by CLI `-j` or `--source-workers` and HarvestView. It defaults
+to six, is reduced when fewer sources are selected, and never skips sources or limits their results.
+
 P1 DNS and P2 direct options are fields on the same run request. The OpenAPI schema shows their current defaults, limits, and descriptions. The server uses the operator-selected target and does not impose a public-only egress policy.
 
 RouteViews is the explicit P0 `routeviews` action. When selected for a domain run, it automatically enriches harvested IPs that have sourced IP-to-ASN attribution. It also accepts an AS-prefixed ASN or IP address supplied as the run target. Harvested IPs without that attribution are not sent, and bare ASN findings are not expanded into complete prefix inventories. For IP pivots, only the most-specific matching prefix is retained, including every origin when that prefix is multi-origin. An explicit ASN target still requests its complete prefix inventory. The fixed internal budget is 300 sequential requests and 300 seconds; `limit` does not change it. A server-side `routeviews.key` is used automatically for PeeringDB-verified authenticated access at the documented 10-request-per-second allowance; otherwise the action uses guest access at one request per second. Provider credentials cannot be supplied in a run request. Returned prefixes remain external relationships and are never scheduled as DNS or P2 targets. The CLI also accepts a literal CIDR target.