Only log high/critical findings to abuse log for fail2ban

Previously all LLM-flagged findings were written to the abuse log,
causing fail2ban to potentially ban IPs for low-severity activity.
Now only high and critical severity findings trigger abuse logging.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web-log-monitor.py

@@ -619,7 +619,8 @@ def process_batch(logs, args):
                                 )
                             except Exception as e:
                                 print(f"  Failed to record LLM finding to DB: {e}")
-                            log_abuse(ip, f.get("type", "unknown"))
+                            if f.get("severity") in ("high", "critical"):
+                                log_abuse(ip, f.get("type", "unknown"))
                 all_findings.extend(findings)
                 print(f"  LLM found suspicious activity: {result.get('summary')}")