feat: scan-only server mode + local build on client

Server:
- config: server.scan_only flag (default: false)
- /api/build returns scan_only=true without building when enabled
- /api/status reports scan_only mode

Client (safe-yay):
- Detects server scan_only from API response
- Scan-only server: builds locally with yay/paru after clean scan
- Full server: installs from pacman repo as before
- --noinstall flag for scan-only without build (was --scan-only)
- Suspicious: prompts for local build or repo install depending on server mode

aur_shield/server.py

@@ -53,6 +53,7 @@ async def status() -> dict[str, Any]:
         "ollama_url": cfg.ollama.url,
         "repo_dir": cfg.server.repo_dir,
         "cached_scans": len(cache.list_all()),
+        "scan_only": cfg.server.scan_only,
     }
 
 
@@ -148,7 +149,19 @@ async def build_endpoint(package: str) -> dict[str, Any]:
         # Allow suspicious but warn
         pass
 
-    # 5. Build
+    # 5. Build (skip if scan_only mode)
+    if cfg.server.scan_only:
+        return {
+            "package": package,
+            "verdict": verdict,
+            "confidence": confidence,
+            "findings": findings,
+            "scan_only": True,
+            "build_success": False,
+            "message": "Scan-only mode — build locally on client",
+        }
+
+    # 6. Build
     build_result = build_package(
         source.pkgbuild, package,
         cfg.server, cfg.build,