[besendorf]

Closes #978.

Summary

Fix all nine findings from the review, without incorporating the separate fixes already proposed in open PRs:

1. Aggregate rechecked module alerts so check-iocs displays accurate severity counts and support messaging.
2. Handle empty domain matchers without crashing valid URL-only or hash-only IOC bundles.
3. Match URL hostnames independently of ports and credentials.
4. Check shortened URL destinations against exact URL indicators, including nested redirects and IP-address destinations.
5. Remove stale alerts, URLs, timelines, and the executing modules' saved outputs when a subsequent extraction is empty, fails, or has no detections.
6. Inspect every configuration-profile payload for notification settings, while preserving known-UUID critical-alert precedence.
7. Interpret Android MMS dates as seconds and SMS dates as milliseconds.
8. Determine Android message direction from SMS type / MMS msg_box, not date_sent.
9. Preserve explicitly UTC application purchase dates regardless of the analyst's timezone.

Output and evidence safety

• Reject an acquisition directory used as its own output directory, including symlink aliases, before creating logs or clearing files.
• Also reject generated output paths that would overwrite the explicit acquisition/input file.
• Standalone module execution and direct saves receive the same protection.
• Sibling and nested output directories remain supported. Cleanup is limited to the executing modules' own output names and known aggregate outputs; unrelated/unselected files and saved check-iocs inputs remain untouched.
• Message direction remains a string; drafts and missing/unsupported mailbox states are reported as "unknown" rather than inferred from a timestamp.

No dependency or lockfile changes.

Validation

With locked dependencies:

• Python 3.12: make check — Ruff passed; Mypy passed for all 156 source files.
• Python 3.12: full pytest suite — 646 passed, 1 skipped.
• Python 3.10: full pytest suite — 646 passed, 1 skipped.
• git diff --check passed.

Regression tests cover all nine findings, real bundled Android backups and URL timestamps, both platform summaries, output-directory reuse, failed/empty extraction, configuration-profile payload order, and winter/summer dates in UTC, Berlin, and New York. New URL regression cases also fail against unpatched main. The new safety guard was additionally checked with actual AndroidQF RootBinaries extraction: same-directory and symlink-alias output are rejected without changing evidence; a distinct output directory still produces the expected HIGH alert.