Fix critical bugs in bot-analyzer: gzipped file access, performance, and scoping issues

CRITICAL FIXES:
- Fix gzipped file access bug causing script to hang at "Calculating threat scores"
  - Changed all parsed_logs.txt references to use zcat on .gz files
  - Fixed lines 1203, 1315, 1324, 1800, 1807, 1810, 1823-1824, 2781

- Fix user_domains scoping bug preventing user filtering (-u flag)
  - Export user_domains from main() before parse_logs() call

- Fix TOOLKIT_BASE_DIR undefined variable
  - Changed to SCRIPT_DIR in lines 1551, 2732

CODE QUALITY:
- Add missing BOLD color code definition
- Add is_valid_ip() function for IPv4/IPv6 validation
- Integrate IP validation into is_excluded_ip() to prevent malformed data

PERFORMANCE OPTIMIZATION:
- Major optimization in analyze_domain_threats()
  - Create indexed lookup files (one-time decompression)
  - Eliminates nested zcat calls (was 4x per IP per domain)
  - Expected 10-100x speedup for servers with 200+ domains

SYSTEM DETECTION:
- Add firewall detection exports to system-detect.sh

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

lib/system-detect.sh

@@ -25,6 +25,9 @@ export SYS_LOG_DIR=""
 export SYS_USER_HOME_BASE=""
 export SYS_PHP_VERSIONS=()
 export SYS_CLOUDFLARE_ACTIVE=""
+export SYS_FIREWALL=""
+export SYS_FIREWALL_VERSION=""
+export SYS_FIREWALL_ACTIVE=""
 
 #############################################################################
 # CONTROL PANEL DETECTION