feat(nuisance): edge nuisance-block sweep + founder-directed blocks [#796]

Cloudron-native enforcement (ipset cloudron_blocklist via panel setting).

https://projects.knownelement.com/issues/796

perf/nuisance/nuisance-detect.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# perf/nuisance/nuisance-detect.sh — HOST-side nuisance candidate detection [#796]
+#
+# Runs on the Cloudron host (systemd timer, 07:15 CDT daily + at boot).
+# No secrets, no API: scans the mail container's Haraka log for sources
+# DENIED via zen.spamhaus.org in the last 24h and writes a ranked
+# candidates file the daily automation cross-checks. Detection is
+# independent of the LLM automation; enforcement stays in
+# nuisance-sweep.sh (Cloudron blocklist API).
+#
+# Output: /home/yellowtent/platformdata/nuisance/candidates.txt
+#   lines: <hits24h> <ip> <BLOCKED|seen>   (BLOCKED = already in ipset)
+
+set -u
+
+OUT_DIR=/home/yellowtent/platformdata/nuisance
+OUT="$OUT_DIR/candidates.txt"
+SET_NAME=cloudron_blocklist
+
+mkdir -p "$OUT_DIR"
+TMP=$(mktemp) || exit 1
+trap 'rm -f "$TMP"' EXIT
+
+docker logs mail --since 24h 2>&1 \
+    | grep -a "plugin=dns-list" \
+    | grep -a "retval=DENY" \
+    | grep -aoE "host \[[0-9.]+\]" \
+    | sed "s/^host \[//; s/\]$//" | sort | uniq -c | sort -rn > "$TMP"
+
+{
+    printf '# nuisance candidates — Haraka spamhaus-DENY sources, 24h, generated %s\n' \
+        "$(date '+%F %T %Z')"
+    printf '# format: <hits24h> <ip> <BLOCKED|seen>  (BLOCKED = covered by %s)\n' "$SET_NAME"
+    while read -r hits ip; do
+        [ -n "$ip" ] || continue
+        if ipset test "$SET_NAME" "$ip" > /dev/null 2>&1; then
+            state=BLOCKED
+        else
+            state=seen
+        fi
+        printf '%s %s %s\n' "$hits" "$ip" "$state"
+    done < "$TMP"
+} > "$OUT"