Switch from clamscan to clamd + clamdscan --multiscan

clamscan single-threaded scans were the LS26 bottleneck. Daemon mode
parallelises across MaxThreads=8 and only loads signatures once.

- Add clamav-daemon + clamav-clamdscan packages.
- start.sh::start_clamd waits up to 60s for /tmp/clamd.sock.
- New clamd.conf: MaxThreads 8, DetectPUA, AlertOLE2Macros,
  ExcludePath ^/data/(proc|sys|dev|run)/, log to /tmp/clamd.log.
- Drop final USER user so clamd can own its socket as clamav.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

clamd.conf

@@ -0,0 +1,14 @@
+LocalSocket /tmp/clamd.sock
+Foreground no
+MaxThreads 8
+MaxScanSize 400M
+MaxFileSize 100M
+MaxRecursion 8
+DetectPUA yes
+AlertOLE2Macros yes
+ConcurrentDatabaseReload no
+ExcludePath ^/data/(proc|sys|dev|run)/
+DatabaseDirectory /var/lib/clamav
+LogSyslog no
+LogFile /tmp/clamd.log
+LogVerbose no