feat: implement Phase 4 enhancements

- Migrate frontend to Alpine.js for reactive state management
- Add source health dashboard in UI and /api/source-health endpoint
- Add event tagging (PATCH /api/events/{id}/tags) and commenting (POST /api/events/{id}/comments)
- Add CSV/JSON export from the UI
- Add rule-based alerting engine (rules.py) with CRUD endpoints (/api/rules)
- Add SIEM export via webhook (siem.py)
- Add AOC audit trail middleware logging all mutations to aoc_audit collection
- Update config with SIEM_ENABLED, SIEM_WEBHOOK_URL, ALERTS_ENABLED
- Add tests for rules engine, tags, comments, and source health

README.md

@@ -72,11 +72,20 @@ uvicorn main:app --reload --host 0.0.0.0 --port 8000
   - Intune audit logs (`/deviceManagement/auditEvents`)
   Dedupes on a stable key (source id or timestamp/category/operation/target). Returns count and per-source warnings.
   - **Incremental fetch**: each source remembers its last successful fetch time in MongoDB (`watermarks` collection). Subsequent calls fetch only new events since the watermark.
+  - **Alerting**: if `ALERTS_ENABLED=true`, events are evaluated against stored rules during ingestion.
+  - **SIEM export**: if `SIEM_ENABLED=true`, each ingested event is forwarded to `SIEM_WEBHOOK_URL`.
 - `GET /api/events` — list stored events with filters:
   - `service`, `actor`, `operation`, `result`, `start`, `end`, `search` (free text over raw/summary/actor/targets)
   - Pagination: `cursor`-based (`page_size` defaults to 50, max 500). Pass `cursor` from `next_cursor` to paginate forward.
 - `GET /api/filter-options` — best-effort distinct values for services, operations, results, actors (used by UI dropdowns).
 - `POST /api/webhooks/graph` — receive Microsoft Graph change notifications. Echoes `validationToken` when present.
+- `GET /api/source-health` — last fetch status for each ingestion source (`directory`, `unified`, `intune`).
+- `PATCH /api/events/{id}/tags` — update tags on an event (e.g., `investigating`, `false_positive`).
+- `POST /api/events/{id}/comments` — add a comment to an event.
+- `GET /api/rules` — list alert rules.
+- `POST /api/rules` — create an alert rule.
+- `PUT /api/rules/{id}` — update an alert rule.
+- `DELETE /api/rules/{id}` — delete an alert rule.
 
 Stored document shape (collection `micro_soc.events`):
 ```json