Fix live-attack-monitor auto-blocking and bot-analyzer compression

- live-attack-monitor.sh:
  * Remove snapshot loading (start fresh each session)
  * Fix Apache log monitoring to use tail -n 0 -F (only new entries)
  * Add IP file sync to main loop for auto-blocking to work
  * Fix IP_DATA consolidation for cross-process communication

- bot-analyzer.sh:
  * Implement gzip compression for large temp files (10-20x space savings)
  * Update all read/write operations to use compressed files
  * Fix for servers with 200+ domains and millions of log entries

- run.sh:
  * Add HISTFILE fallback to prevent crashes when sourced

run.sh

@@ -8,6 +8,15 @@
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
+# Fix HISTFILE if set to non-existent path (prevents crashes on sourcing)
+if [ -n "$HISTFILE" ]; then
+    HISTFILE_DIR="$(dirname "$HISTFILE" 2>/dev/null)"
+    if [ ! -d "$HISTFILE_DIR" ] 2>/dev/null; then
+        # Fallback to default history location
+        export HISTFILE="$HOME/.bash_history"
+    fi
+fi
+
 # Check if being sourced or executed
 if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
     echo "ERROR: This script must be sourced, not executed."