-- Make inotify real-time scanning opt-in.
-- ClamAV-on-demand re-introduced 2026-04-27 (clamav binary only, no daemons —
-- per inotify cycle clamscan loads the 1.7GB sig DB into RAM, scans the
-- batch, exits. Admin opts in to accept the per-cycle RAM peak.
ALTER TABLE malware_settings
  MODIFY COLUMN realtime_enabled TINYINT(1) NOT NULL DEFAULT 0;

UPDATE malware_settings SET realtime_enabled = 0 WHERE id = 1;
