fix(mitmproxy): Fix false positives for legitimate browsers

- Remove 'mozilla/5.0' from BOT_SIGNATURES - was flagging ALL modern
  browsers as bots since this is the standard UA prefix
- Fix suspicious UA detection - no longer flags normal browsers
- Increase CrowdSec bruteforce threshold from 5/30s to 10/60s to reduce
  false positives from normal login flows

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude/settings.local.json

@@ -336,7 +336,11 @@
       "Bash(pip3 show:*)",
       "Bash(playwright install:*)",
       "Bash(timeout 8 streamlit run:*)",
-      "Bash(cgroup at_mnt\" error on certain kernel configurations\\)\n- Disable cgroup memory limit since cgroup is not mounted\n- Fixes Gitea container failing to start with cgroup mount errors\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n\\)\")"
+      "Bash(cgroup at_mnt\" error on certain kernel configurations\\)\n- Disable cgroup memory limit since cgroup is not mounted\n- Fixes Gitea container failing to start with cgroup mount errors\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n\\)\")",
+      "Bash(while [ -f /tmp/claude/-home-reepost-CyberMindStudio-secubox-openwrt/tasks/be0c3bc.running ])",
+      "Bash(do sleep 5)",
+      "Bash(while ps aux)",
+      "Bash(do sleep 10)"
     ]
   }
 }