feat: scan-only server mode + local build on client

Server:
- config: server.scan_only flag (default: false)
- /api/build returns scan_only=true without building when enabled
- /api/status reports scan_only mode

Client (safe-yay):
- Detects server scan_only from API response
- Scan-only server: builds locally with yay/paru after clean scan
- Full server: installs from pacman repo as before
- --noinstall flag for scan-only without build (was --scan-only)
- Suspicious: prompts for local build or repo install depending on server mode

aur_shield/config.py

@@ -23,6 +23,7 @@ class ServerConfig:
     repo_dir: str = "/var/cache/aur-shield/repo"
     work_dir: str = "/var/cache/aur-shield/build"
     build_user: str = "nobody"
+    scan_only: bool = False
 
 
 @dataclass