feat: implement Phase 4 enhancements

- Migrate frontend to Alpine.js for reactive state management
- Add source health dashboard in UI and /api/source-health endpoint
- Add event tagging (PATCH /api/events/{id}/tags) and commenting (POST /api/events/{id}/comments)
- Add CSV/JSON export from the UI
- Add rule-based alerting engine (rules.py) with CRUD endpoints (/api/rules)
- Add SIEM export via webhook (siem.py)
- Add AOC audit trail middleware logging all mutations to aoc_audit collection
- Update config with SIEM_ENABLED, SIEM_WEBHOOK_URL, ALERTS_ENABLED
- Add tests for rules engine, tags, comments, and source health

backend/routes/health.py

@@ -0,0 +1,30 @@
+
+from auth import require_auth
+from fastapi import APIRouter, Depends
+from models.api import SourceHealthResponse
+from watermark import watermarks_collection
+
+router = APIRouter(dependencies=[Depends(require_auth)])
+
+SOURCES = ["directory", "unified", "intune"]
+
+
+@router.get("/source-health", response_model=list[SourceHealthResponse])
+def source_health():
+    """Return the last known fetch status for each ingestion source."""
+    results = []
+    for source in SOURCES:
+        doc = watermarks_collection.find_one({"source": source})
+        if doc and doc.get("last_fetch_time"):
+            results.append({
+                "source": source,
+                "last_fetch_time": doc["last_fetch_time"],
+                "status": "healthy",
+            })
+        else:
+            results.append({
+                "source": source,
+                "last_fetch_time": None,
+                "status": "unknown",
+            })
+    return results