BUG FIX #13 & #14: Variable scope issues with target_ports and has_other_traffic

ISSUE:
Two more variables (target_ports and has_other_traffic) had the same scope issue:
declared inside the skip_scoring block but used outside in intel_tags logic.

ROOT CAUSE:
Similar pattern to previous scope bugs:
- Line 2859: local has_other_traffic=0  [INSIDE skip_scoring]
- Line 2861: local target_ports=...     [INSIDE skip_scoring]
- Line 3038: [ "$has_other_traffic" -eq 0 ] && intel_tags="...SPOOFED"  [OUTSIDE]
- Line 3038: [ "${target_ports:-0}" -eq 1 ] && intel_tags="...TARGETED"  [OUTSIDE]

When skip_scoring=1 (whitelisted IP), these variables are never initialized.
Undefined variables default to empty strings in bash, causing silent failures.

IMPACT:
- Whitelisted IPs: SPOOFED and TARGETED tags never shown
- Intel tags incomplete for whitelisted IPs
- Missing important threat indicators in threat summary
- Inconsistent threat classification

TIMELINE OF FAILURE:
1. skip_scoring=1 (IP is whitelisted, e.g., 20+ established connections)
2. skip_scoring block NOT executed (lines 2761-2976)
3. has_other_traffic NEVER initialized
4. target_ports NEVER initialized
5. Line 3038-3039: Both variables undefined, conditions fail
6. SPOOFED and TARGETED tags not added to intel_tags
7. User sees incomplete threat assessment

FIX:
Move both variable declarations OUTSIDE skip_scoring block:
- Initialize: local has_other_traffic=0
- Initialize: local target_ports=0
- Use these variables in skip_scoring calculations (assign values)
- Use same variables outside skip_scoring (no re-declaration needed)

This is now the 5th variable with this scope issue (multi_vector, geo_bonus,
ratio, target_ports, has_other_traffic). All now fixed in one place.

VERIFICATION:
- Syntax: ✓ Pass
- Scope: ✓ Both variables available inside and outside skip_scoring
- Logic: ✓ Values properly propagated to intel_tags

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

modules/security/live-attack-monitor-v2.sh

@@ -2749,12 +2749,15 @@ monitor_network_attacks() {
                                 fi
 
                                 # CRITICAL FIX: Declare variables before skip_scoring block
-                                # Bug: multi_vector, geo_bonus, and ratio were declared inside skip_scoring but used outside
-                                # When skip_scoring=1, local vars never initialized, causing undefined variable in intel_tags logic
+                                # Bug: multi_vector, geo_bonus, ratio, target_ports, and has_other_traffic
+                                #      were declared inside skip_scoring but used outside in intel_tags logic
+                                # When skip_scoring=1, local vars never initialized, causing undefined variable errors
                                 # Fix: Move declarations outside skip_scoring so they're always available
                                 local multi_vector=0
                                 local geo_bonus=0
                                 local ratio=0
+                                local target_ports=0
+                                local has_other_traffic=0
 
                                 # Only do scoring/tracking if not whitelisted
                                 if [ "$skip_scoring" -eq 0 ]; then
@@ -2833,7 +2836,7 @@ monitor_network_attacks() {
                                     # Bug: was trying to read from individual ip_* file which may not exist
                                     # If this is first SYN detection of an IP with prior HTTP attacks, file won't exist
                                     # Result: has_other_traffic stays 0, missing indicator of multi-attack IP
-                                    local has_other_traffic=0
+                                    # Note: has_other_traffic declared outside skip_scoring block (line ~2760) for scope
                                     # If has HTTP attacks in history, not spoofed
                                     if [[ "$attacks" =~ (SQLI|XSS|BRUTE|SCAN) ]]; then
                                         has_other_traffic=1
@@ -2851,7 +2854,8 @@ monitor_network_attacks() {
                                     # Bug: Unquoted 'src "$ip"' was treated as separate arguments, not a filter expression
                                     # Result: ss silently ignores the filter and returns ALL syn-recv (giving wrong port count)
                                     # Fix: Quote the expression so ss parses it correctly: 'src IP'
-                                    local target_ports=$(ss -tn "state syn-recv src $ip" 2>/dev/null | grep -oP ':\d+\s+' | sort -u | wc -l)
+                                    # Note: target_ports declared outside skip_scoring block (line ~2760) for scope
+                                    target_ports=$(ss -tn "state syn-recv src $ip" 2>/dev/null | grep -oP ':\d+\s+' | sort -u | wc -l)
                                     [ -z "$target_ports" ] && target_ports=0
                                     if [ "$target_ports" -eq 1 ] && [ "$count" -ge 8 ]; then
                                         conn_bonus=$((conn_bonus + 10))  # Single port = targeted attack