feat: scan-only server mode + local build on client

Server:
- config: server.scan_only flag (default: false)
- /api/build returns scan_only=true without building when enabled
- /api/status reports scan_only mode

Client (safe-yay):
- Detects server scan_only from API response
- Scan-only server: builds locally with yay/paru after clean scan
- Full server: installs from pacman repo as before
- --noinstall flag for scan-only without build (was --scan-only)
- Suspicious: prompts for local build or repo install depending on server mode

config.example.yaml

@@ -9,6 +9,7 @@ server:
   repo_dir: /var/cache/aur-shield/repo
   work_dir: /var/cache/aur-shield/build
   build_user: nobody  # never build as root
+  scan_only: true  # if true, /api/build returns scan result without building
 
 security:
   block_patterns: