feat: IOC pre-check via public threat intel (AegisAUR integration)

- ioc_fetcher.py: fetches from HedgeDoc, Atomic Arch Gist, Arch Security
  Tracker, AUR RPC orphan detection (concurrent)
- scanner.py: IOC pre-check before LLM scan — known malicious packages
  get instant MALICIOUS verdict without LLM cost
- typosquatting check with Levenshtein distance
- server.py: API returns ioc_matches + typosquat_matches
- README: threat intel sources documented

Sources ported from AegisAUR (Rust) to Python.

README.md

@@ -92,18 +92,30 @@ cache:
 
 ## How It Works
 
-1. **Request:** Client asks for `aur-shield/<package>`
+1. **IOC Pre-Check:** Package name checked against public threat lists (HedgeDoc, Atomic Arch Gist, Arch Security Tracker, AUR Orphan detection). Known malicious → instant block, no LLM needed.
 2. **Fetch:** Server pulls PKGBUILD + .SRCINFO from AUR API
-3. **Scan:** LLM analyzes the PKGBUILD for:
+3. **Regex Pre-Scan:** Fast pattern matching for `curl|bash`, `eval|base64`, `/dev/tcp`, etc.
+4. **LLM Scan:** Ollama analyzes the PKGBUILD for:
    - Suspicious `source=()` URLs (npm, tor, raw IPs)
    - Obfuscated bash (`eval`, `base64 -d`, hex encoding)
    - Reverse shells, `nc`, `/dev/tcp`
    - `post_install` hooks creating services/cronjobs
    - Typosquatting package names
    - Unusual `depends` for the package type
-4. **Build:** If clean, `makepkg` builds the package
-5. **Serve:** `repo-add` adds it to the local pacman repo
-6. **Cache:** Approved packages stay cached until upstream update
+5. **Build:** If clean, `makepkg` builds the package
+6. **Serve:** `repo-add` adds it to the local pacman repo
+7. **Cache:** Approved packages stay cached until upstream update
+
+## Threat Intelligence Sources
+
+Based on [AegisAUR](https://gitea.die-heimatlosen.eu/arch_agent/aegisaur) IOC fetcher:
+
+| Source | Type | Freshness | URL |
+|--------|------|-----------|-----|
+| HedgeDoc | Live paste | Always current | `md.archlinux.org/s/SxbqukK6IA` |
+| Atomic Arch Gist | GitHub Gist | Versioned | `gist.githubusercontent.com/Kidev/...` |
+| Arch Security | Official advisory | Slow but authoritative | `security.archlinux.org` |
+| AUR RPC | API | Real-time | `aur.archlinux.org/rpc/v5` |
 
 ## API