A unified, pluggable API for malware scanning with circuit breakers, policy enforcement, and audit logging