Zero-dependency server log triage: SSH brute-force, compromise signals, web scanners, firewall block detection