feat: implement Phase 4 enhancements

- Migrate frontend to Alpine.js for reactive state management
- Add source health dashboard in UI and /api/source-health endpoint
- Add event tagging (PATCH /api/events/{id}/tags) and commenting (POST /api/events/{id}/comments)
- Add CSV/JSON export from the UI
- Add rule-based alerting engine (rules.py) with CRUD endpoints (/api/rules)
- Add SIEM export via webhook (siem.py)
- Add AOC audit trail middleware logging all mutations to aoc_audit collection
- Update config with SIEM_ENABLED, SIEM_WEBHOOK_URL, ALERTS_ENABLED
- Add tests for rules engine, tags, comments, and source health

backend/models/api.py

@@ -1,4 +1,3 @@
-
 from pydantic import BaseModel, ConfigDict
 
 
@@ -17,6 +16,8 @@ class EventItem(BaseModel):
     targets: list[dict] | None = None
     raw: dict | None = None
     raw_text: str | None = None
+    tags: list[str] | None = None
+    comments: list[dict] | None = None
 
     model_config = ConfigDict(extra="allow")
 
@@ -40,3 +41,26 @@ class FilterOptionsResponse(BaseModel):
 class FetchAuditLogsResponse(BaseModel):
     stored_events: int
     errors: list[str]
+
+
+class SourceHealthResponse(BaseModel):
+    source: str
+    last_fetch_time: str | None = None
+    status: str
+
+
+class TagsUpdateRequest(BaseModel):
+    tags: list[str]
+
+
+class CommentAddRequest(BaseModel):
+    text: str
+
+
+class AlertRuleResponse(BaseModel):
+    id: str | None = None
+    name: str
+    enabled: bool
+    severity: str
+    conditions: list[dict]
+    message: str