feat: IOC pre-check via public threat intel (AegisAUR integration)

- ioc_fetcher.py: fetches from HedgeDoc, Atomic Arch Gist, Arch Security
  Tracker, AUR RPC orphan detection (concurrent)
- scanner.py: IOC pre-check before LLM scan — known malicious packages
  get instant MALICIOUS verdict without LLM cost
- typosquatting check with Levenshtein distance
- server.py: API returns ioc_matches + typosquat_matches
- README: threat intel sources documented

Sources ported from AegisAUR (Rust) to Python.

aur_shield/server.py

@@ -100,6 +100,8 @@ async def scan_package(package: str) -> dict[str, Any]:
         "reasoning": result.reasoning,
         "sources": result.sources_checked,
         "version": source.package.version,
+        "ioc_matches": result.ioc_matches,
+        "typosquat_matches": result.typosquat_matches,
     }