feat: -Syu system update + --check-installed for installed AUR packages

- safe-yay -Syu: scans AUR updates through AUR-Shield before installing,
  blocks malicious updates, prompts for suspicious ones
- safe-yay --check-installed: checks all installed AUR packages (pacman -Qmq)
  against IOC lists — like archcanary's installed-package scan
- Both use exit codes: 0=clean, 1=warning, 2=malicious

README.md

@@ -136,8 +136,29 @@ Based on [AegisAUR](https://gitea.die-heimatlosen.eu/arch_agent/aegisaur) IOC fe
 - `GET /api/build/<package>` — Scan + build + add to repo
 - `GET /api/status` — Server status + cache info
 - `GET /api/report/<package>` — Get last scan report
+- `GET /api/cache` — List all cached scan results
+- `DELETE /api/cache/<package>` — Clear cached scan for a package
 - `GET /repo/<file>` — Pacman repo endpoint (for client pacman.conf)
 
+## Client Usage
+
+```bash
+# Neue Pakete installieren (Scan + Build + Install)
+safe-yay <package>
+
+# System-Update (AUR-Updates werden gescannt vor Installation)
+safe-yay -Syu
+
+# Nur scannen, nicht installieren
+safe-yay --scan-only <package>
+
+# Installierte AUR-Pakete gegen IOC-Listen pruefen
+safe-yay --check-installed
+
+# Setup-Verifikation
+safe-yay --doctor
+```
+
 ## Models
 
 Tested models (smallest to best):