feat: implement Phase 4 enhancements

- Migrate frontend to Alpine.js for reactive state management
- Add source health dashboard in UI and /api/source-health endpoint
- Add event tagging (PATCH /api/events/{id}/tags) and commenting (POST /api/events/{id}/comments)
- Add CSV/JSON export from the UI
- Add rule-based alerting engine (rules.py) with CRUD endpoints (/api/rules)
- Add SIEM export via webhook (siem.py)
- Add AOC audit trail middleware logging all mutations to aoc_audit collection
- Update config with SIEM_ENABLED, SIEM_WEBHOOK_URL, ALERTS_ENABLED
- Add tests for rules engine, tags, comments, and source health

backend/main.py

@@ -5,6 +5,7 @@ from contextlib import suppress
 from pathlib import Path
 
 import structlog
+from audit_trail import log_action
 from config import CORS_ORIGINS, ENABLE_PERIODIC_FETCH, FETCH_INTERVAL_MINUTES
 from database import setup_indexes
 from fastapi import FastAPI, HTTPException, Request
@@ -17,6 +18,8 @@ from routes.config import router as config_router
 from routes.events import router as events_router
 from routes.fetch import router as fetch_router
 from routes.fetch import run_fetch
+from routes.health import router as health_router
+from routes.rules import router as rules_router
 from routes.webhooks import router as webhooks_router
 
 
@@ -66,10 +69,37 @@ async def prometheus_middleware(request: Request, call_next):
     return response
 
 
+@app.middleware("http")
+async def audit_middleware(request: Request, call_next):
+    response = await call_next(request)
+    if request.url.path.startswith("/api/") and request.method in ("POST", "PATCH", "PUT", "DELETE"):
+        from auth import AUTH_ENABLED
+        user = "anonymous"
+        if AUTH_ENABLED:
+            auth_header = request.headers.get("authorization", "")
+            if auth_header.lower().startswith("bearer "):
+                try:
+                    from jose import jwt
+                    token = auth_header.split(" ", 1)[1]
+                    claims = jwt.get_unverified_claims(token)
+                    user = claims.get("sub", "unknown")
+                except Exception:
+                    pass
+        log_action(
+            action=request.method.lower(),
+            resource=request.url.path,
+            details={"status_code": response.status_code},
+            user=user,
+        )
+    return response
+
+
 app.include_router(fetch_router, prefix="/api")
 app.include_router(events_router, prefix="/api")
 app.include_router(config_router, prefix="/api")
 app.include_router(webhooks_router, prefix="/api")
+app.include_router(health_router, prefix="/api")
+app.include_router(rules_router, prefix="/api")
 
 
 @app.get("/health")