Move all persistent data to /tmp (no system pollution)

Moved from /var/lib/server-toolkit/ to /tmp/:
- Threat intelligence cache
- Whitelist IPs
- Attack pattern logs
- Incident reports
- Shared threat coordination logs
- Live monitor snapshots

Philosophy: Deleting toolkit directory should remove ALL data.
System directories (/var/lib/) caused stale data to persist.
Using /tmp/ ensures auto-cleanup on reboot and complete removal.

modules/security/live-attack-monitor-v2.sh

@@ -57,7 +57,7 @@ TERMINAL_HEIGHT=$(tput lines 2>/dev/null || echo "24")
 
 # Temporary files for tracking
 TEMP_DIR="/tmp/live-monitor-$$"
-SNAPSHOT_DIR="/var/lib/server-toolkit/live-monitor"
+SNAPSHOT_DIR="/tmp/server-toolkit-live-monitor"
 mkdir -p "$TEMP_DIR" "$SNAPSHOT_DIR" 2>/dev/null
 touch "$TEMP_DIR/recent_events"
 touch "$TEMP_DIR/ip_data"

modules/security/live-attack-monitor.sh

@@ -57,7 +57,7 @@ TERMINAL_HEIGHT=$(tput lines 2>/dev/null || echo "24")
 
 # Temporary files for tracking
 TEMP_DIR="/tmp/live-monitor-$$"
-SNAPSHOT_DIR="/var/lib/server-toolkit/live-monitor"
+SNAPSHOT_DIR="/tmp/server-toolkit-live-monitor"
 mkdir -p "$TEMP_DIR" "$SNAPSHOT_DIR" 2>/dev/null
 touch "$TEMP_DIR/recent_events"
 touch "$TEMP_DIR/ip_data"