Create flagged bot IP entries for security engineers before review

Your bot IP table updates arrive untracked, creating blind spots in threat detection and delayed blocking. Security engineers receive deduplicated IP records and a review-ready sheet before the next security review.