Hash every validated server copy and register it as verified content

Dockerfile

@@ -24,6 +24,14 @@ RUN apt-get update -qq && \
       ca-certificates && \
     rm -rf /var/lib/apt/lists/*
 
+# Optional malware scanner for P2P admission (P2P_MALWARE_SCAN=1). Off by
+# default: build with --build-arg INSTALL_CLAMAV=1 to include it.
+ARG INSTALL_CLAMAV=0
+RUN if [ "$INSTALL_CLAMAV" = "1" ]; then \
+      apt-get update -qq && apt-get install -y --no-install-recommends clamav clamav-freshclam && \
+      freshclam --quiet || true; rm -rf /var/lib/apt/lists/*; \
+    fi
+
 # ---- Install yt-dlp ----
 RUN curl -fsSL \
       https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp \