fix: /api/scan returns scan_only flag + -S flag handling in client

- server.py: /api/scan now includes scan_only in response
- client: -S <pkg> flag properly stripped (was treated as package name)
- client: detects scan_only from scan response to decide local vs repo

aur_shield/server.py

@@ -103,6 +103,7 @@ async def scan_package(package: str) -> dict[str, Any]:
         "version": source.package.version,
         "ioc_matches": result.ioc_matches,
         "typosquat_matches": result.typosquat_matches,
+        "scan_only": cfg.server.scan_only,
     }