Restructure sources into app package with unified entry point and update documentation

app/utils.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+"""Shared core for the local-dev intrusion-detection scripts.
+
+`copyparty.py` and `npm.py` are thin adapters. They only provide:
+
+  * a log-file matcher (glob-ish pattern / suffixes)
+  * a line parser producing `Request` objects
+  * a flagging rule (which IPs look hostile)
+  * column definitions for their CSV output
+
+Everything else -- IP aggregation, whitelisting, console + file reports,
+MikroTik RouterOS export -- lives in this module.
+"""
+
+from __future__ import annotations
+
+import argparse
+
+
+def arg_parser(description: str, default_log_path: str,
+               default_report_dir: str) -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(description=description)
+    p.add_argument("--log-path", default=default_log_path,
+                   help=f"log directory (default: {default_log_path})")
+    p.add_argument("--report-dir", default=default_report_dir,
+                   help=f"report output dir (default: {default_report_dir})")
+    p.add_argument("--top", type=int, default=30,
+                   help="rows in the top-IP table (default: 30)")
+    p.add_argument("--quiet", action="store_true",
+                   help="write files, print nothing but the paths")
+    p.add_argument("--no-rsc", action="store_true",
+                   help="skip MikroTik .rsc generation")
+    return p