feat: implement Phase 4 enhancements

- Migrate frontend to Alpine.js for reactive state management
- Add source health dashboard in UI and /api/source-health endpoint
- Add event tagging (PATCH /api/events/{id}/tags) and commenting (POST /api/events/{id}/comments)
- Add CSV/JSON export from the UI
- Add rule-based alerting engine (rules.py) with CRUD endpoints (/api/rules)
- Add SIEM export via webhook (siem.py)
- Add AOC audit trail middleware logging all mutations to aoc_audit collection
- Update config with SIEM_ENABLED, SIEM_WEBHOOK_URL, ALERTS_ENABLED
- Add tests for rules engine, tags, comments, and source health

backend/config.py

@@ -35,6 +35,13 @@ class Settings(BaseSettings):
     # CORS
     CORS_ORIGINS: str = "*"
 
+    # SIEM export
+    SIEM_ENABLED: bool = False
+    SIEM_WEBHOOK_URL: str = ""
+
+    # Alerting
+    ALERTS_ENABLED: bool = False
+
 
 _settings = Settings()
 
@@ -57,3 +64,7 @@ AUTH_ALLOWED_GROUPS = {g.strip() for g in _settings.AUTH_ALLOWED_GROUPS.split(",
 
 RETENTION_DAYS = _settings.RETENTION_DAYS
 CORS_ORIGINS = [o.strip() for o in _settings.CORS_ORIGINS.split(",") if o.strip()]
+
+SIEM_ENABLED = _settings.SIEM_ENABLED
+SIEM_WEBHOOK_URL = _settings.SIEM_WEBHOOK_URL
+ALERTS_ENABLED = _settings.ALERTS_ENABLED