feat: implement Phase 4 enhancements

- Migrate frontend to Alpine.js for reactive state management
- Add source health dashboard in UI and /api/source-health endpoint
- Add event tagging (PATCH /api/events/{id}/tags) and commenting (POST /api/events/{id}/comments)
- Add CSV/JSON export from the UI
- Add rule-based alerting engine (rules.py) with CRUD endpoints (/api/rules)
- Add SIEM export via webhook (siem.py)
- Add AOC audit trail middleware logging all mutations to aoc_audit collection
- Update config with SIEM_ENABLED, SIEM_WEBHOOK_URL, ALERTS_ENABLED
- Add tests for rules engine, tags, comments, and source health

.env.example

@@ -23,3 +23,10 @@ RETENTION_DAYS=0
 
 # Optional: comma-separated CORS origins (e.g., http://localhost:3000,https://app.example.com)
 CORS_ORIGINS=*
+
+# Optional: SIEM export webhook (e.g., Splunk HEC, Sentinel, or generic syslog webhook)
+SIEM_ENABLED=false
+SIEM_WEBHOOK_URL=
+
+# Optional: enable rule-based alerting during ingestion
+ALERTS_ENABLED=false