feat: nouvelles techniques de détection et page tactiques SOC

SQL:
- Ajout 5 colonnes d'agrégation (count_xff, count_unusual_ct,
  count_non_std_port, count_login_post, sec_ch_mobile_mismatch)
- Exposition de 5 features calculées dans view_ai_features_1h
- Migration ALTER TABLE pour déploiements existants

Bot-detector:
- 7 nouvelles features ML (has_xff, unusual_content_type_ratio,
  non_standard_port_ratio, login_post_concentration,
  sec_ch_mobile_mismatch, true_window_size, window_mss_ratio)
- Propagation campaign_id vers ml_all_scores (était toujours -1)
- Escalade campagne : HIGH→CRITICAL si cluster ≥5 membres

Dashboard:
- Page Tactiques SOC : brute-force, rotation JA4, récurrence,
  alertes temps réel — 4 KPIs + 4 panneaux + infobulles doc
- Ajout fmtDate() helper global
- Navigation sidebar mise à jour

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

shared/clickhouse/05_aggregation_tables.sql

@@ -112,6 +112,11 @@ CREATE TABLE IF NOT EXISTS ja4_processing.agg_host_ip_ja4_1h
     -- HTTP features
     count_no_accept_enc SimpleAggregateFunction(sum, UInt64),
     count_http_scheme SimpleAggregateFunction(sum, UInt64),
+    -- P1 : nouvelles features de détection
+    count_xff SimpleAggregateFunction(sum, UInt64),
+    count_unusual_ct SimpleAggregateFunction(sum, UInt64),
+    count_non_std_port SimpleAggregateFunction(sum, UInt64),
+    count_login_post SimpleAggregateFunction(sum, UInt64),
 
     -- Projection pour les requêtes d'investigation par IP :
     -- ORDER BY actuel (window_start, src_ip, ...) est optimal pour heatmap
@@ -157,7 +162,7 @@ SELECT
     sum(IF(match(src.path, '(?i)\.(png|jpg|jpeg|gif|css|js|ico|woff2|svg|eot)$'), 1, 0)) AS count_assets,
     sum(IF(position(src.client_headers, 'Referer') = 0, 1, 0)) AS count_no_referer,
     uniqState(src.header_user_agent) AS uniq_ua,
-    0 AS max_requests_per_sec,
+    0 AS max_requests_per_sec, -- TODO(P0): calculer via sous-requête par seconde (impossible dans un seul GROUP BY)
     varPopState(toFloat64(length(replaceAll(src.path, '/', '//')) - length(src.path))) AS url_depth_variance,
     sum(IF(src.ip_meta_total_length < 60 OR src.ip_meta_total_length > 1500, 1, 0)) AS count_anomalous_payload,
     uniqState(src.ja3) AS uniq_ja3,
@@ -173,7 +178,13 @@ SELECT
     sum(IF(src.tcp_meta_window_scale = 0 AND src.correlated = 1, 1, 0)) AS count_no_wscale,
     sum(toUInt64(src.correlated)) AS count_correlated,
     sum(IF(length(src.header_accept_encoding) = 0, 1, 0)) AS count_no_accept_enc,
-    sum(IF(src.scheme = 'http', 1, 0)) AS count_http_scheme
+    sum(IF(src.scheme = 'http', 1, 0)) AS count_http_scheme,
+    -- P1 : nouvelles features
+    sum(IF(length(src.header_x_forwarded_for) > 0, 1, 0)) AS count_xff,
+    sum(IF(src.method = 'POST' AND length(src.header_content_type) > 0
+           AND NOT match(src.header_content_type, '(?i)(form-urlencoded|multipart|json|xml|text/plain|grpc|protobuf)'), 1, 0)) AS count_unusual_ct,
+    sum(IF(src.dst_port NOT IN (80, 443, 8080, 8443), 1, 0)) AS count_non_std_port,
+    sum(IF(src.method = 'POST' AND match(src.path, '(?i)(login|signin|auth|token|session|wp-login|connect|oauth)'), 1, 0)) AS count_login_post
 FROM ja4_logs.http_logs AS src
 GROUP BY window_start, src_ip, ja4, host, src_asn;
 
@@ -192,6 +203,7 @@ CREATE TABLE IF NOT EXISTS ja4_processing.agg_header_fingerprint_1h
     has_referer SimpleAggregateFunction(max, UInt8),
     modern_browser_score SimpleAggregateFunction(max, UInt8),
     ua_ch_mismatch SimpleAggregateFunction(max, UInt8),
+    sec_ch_mobile_mismatch SimpleAggregateFunction(max, UInt8),
     sec_fetch_mode SimpleAggregateFunction(any, String),
     sec_fetch_dest SimpleAggregateFunction(any, String)
 )
@@ -212,6 +224,10 @@ SELECT
     max(toUInt8(if(position(src.client_headers, 'Referer') > 0, 1, 0))) AS has_referer,
     max(toUInt8(if(length(src.header_sec_ch_ua) > 0, 100, if(length(src.header_user_agent) > 0, 50, 0)))) AS modern_browser_score,
     max(toUInt8(if((position(src.header_user_agent, 'Windows') > 0 AND position(src.header_sec_ch_ua_platform, 'Windows') == 0) OR (position(src.header_user_agent, 'iPhone') > 0 AND position(src.header_sec_ch_ua_platform, 'iOS') == 0), 1, 0))) AS ua_ch_mismatch,
+    max(toUInt8(if(
+        (src.header_sec_ch_ua_mobile = '?1' AND position(src.header_user_agent, 'Mobile') == 0 AND position(src.header_user_agent, 'Android') == 0 AND position(src.header_user_agent, 'iPhone') == 0)
+        OR (src.header_sec_ch_ua_mobile = '?0' AND (position(src.header_user_agent, 'iPhone') > 0 OR position(src.header_user_agent, 'Android') > 0)),
+        1, 0))) AS sec_ch_mobile_mismatch,
     any(src.header_sec_fetch_mode) AS sec_fetch_mode,
     any(src.header_sec_fetch_dest) AS sec_fetch_dest
 FROM ja4_logs.http_logs AS src