Threat tracker & IP blocking

Active threat monitoring now runs on every request. Bots, scanners, and repeat offenders get logged, rate-limited, and blocked automatically.