8cbf62b243
All background monitoring functions had same subshell bug as SSH: - Cannot access IP_DATA associative array from subshells - Switched to file-based storage: individual ip_* files per IP - Main loop consolidates files into ip_data for auto-mitigation - Fixes Email bruteforce detection (dovecot auth failures) - Fixes FTP bruteforce detection (vsftpd/xferlog) - Fixes Database attack detection (MySQL auth failures) Now ALL monitoring channels work properly: - SSH: file-based ✓ - Email: file-based ✓ - FTP: file-based ✓ - Database: file-based ✓ - Web/Apache: direct display (no subshell) ✓