fix: /api/scan returns scan_only flag + -S flag handling in client

- server.py: /api/scan now includes scan_only in response
- client: -S <pkg> flag properly stripped (was treated as package name)
- client: detects scan_only from scan response to decide local vs repo

install-client.sh

@@ -298,6 +298,13 @@ for ioc in d.get('ioc_matches',[]):
     exit 0
 fi
 
+# -S <pkg>: Install mode (same as default, but skip flags)
+INSTALL_MODE=false
+if [ "$1" = "-S" ]; then
+    INSTALL_MODE=true
+    shift
+fi
+
 # --noinstall mode (scan only, don't build/install)
 NOINSTALL=false
 if [ "$1" = "--noinstall" ] || [ "$1" = "--scan-only" ]; then