Add centralized IP reputation tracking system

Created a comprehensive IP reputation system that tracks IPs across all
toolkit scripts with tags/attack types, scores, and detailed analytics.

NEW FILES:
- lib/ip-reputation.sh: Core reputation library with optimized database
  * Fast lookup using pipe-delimited file format
  * Attack type tagging system (bitmask: SQL, XSS, RCE, Bot, Scanner, etc.)
  * Reputation scoring (0-100) based on hits and attack severity
  * GeoIP country lookup integration
  * Automatic cleanup of old entries
  * Thread-safe with file locking

- modules/security/ip-reputation-manager.sh: Interactive management tool
  * Query individual IPs with full details
  * View top malicious/active IPs
  * Database statistics and analytics
  * Manual IP flagging/whitelisting
  * Import IPs from logs
  * Export to readable reports
  * Live monitoring mode

INTEGRATION:
All security and analysis scripts now use the centralized reputation system:

- modules/website/500-error-tracker.sh:
  * Tracks IPs generating 500 errors
  * Tags bots/scanners with BOT/SCANNER flags
  * Background processing for performance

- modules/security/live-attack-monitor.sh:
  * Maps attack types to reputation flags
  * Tracks SSH bruteforce, SQL injection, XSS, DDoS, etc.
  * Real-time reputation updates

- modules/website/website-error-analyzer.sh:
  * Tags filtered bots in error analysis
  * Builds IP reputation from website errors

- launcher.sh:
  * Added IP Reputation Manager to Bot & Traffic Analysis menu
  * Menu option 4 in Security > Analysis > Bot & Traffic Analysis

KEY FEATURES:
✓ Centralized IP tracking across ALL scripts
✓ Multi-tag system (IP can have multiple attack types)
✓ Reputation scores increase with more tags/attacks
✓ Country tracking via GeoIP
✓ Optimized for high-volume traffic (attacks with 1000s of IPs)
✓ Fast lookups even during DDoS
✓ Background processing doesn't slow down analysis
✓ Database cleanup/maintenance tools
✓ Export for reports and sharing

BENEFITS:
- Single source of truth for IP reputation
- Scripts share intelligence (bot detected in one script = flagged for all)
- Track IPs across time and multiple attack vectors
- Identify repeat offenders with multiple attack types
- Make blocking decisions based on comprehensive data
- Performance optimized with file locking and background updates

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

modules/website/website-error-analyzer.sh

@@ -12,6 +12,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 source "$SCRIPT_DIR/lib/common-functions.sh"
 source "$SCRIPT_DIR/lib/system-detect.sh"
 source "$SCRIPT_DIR/lib/user-manager.sh"
+source "$SCRIPT_DIR/lib/ip-reputation.sh"
 
 # Configuration
 APACHE_ERROR_LOG="/var/log/apache2/error_log"
@@ -450,6 +451,11 @@ while IFS='|' read -r log_path log_type; do
             # Skip if bot/scanner
             if is_noise "$line"; then
                 ((filtered_out++))
+                # Track bot/scanner IPs
+                read -r ip _ _ _ _ _ _ _ <<< "$line"
+                if [[ "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
+                    flag_ip_attack "$ip" "BOT" 0 "Bot/scanner filtered in error analysis" >/dev/null 2>&1 &
+                fi
                 continue
             fi