fix(ja4ebpf): split bpf2go generate into Ja4Tc + Ja4Ssl, fix RPM systemd-rpm-macros

- Use two separate //go:generate directives (Ja4Tc for tc_capture.c, Ja4Ssl
  for uprobe_ssl.c) to avoid duplicate LICENSE symbol and multi-file clang issue
- Update loader.go to hold tcObjs/sslObjs separately with correct field names:
  UprobeSslSetFd, UprobeSslReadEntry, UretprobeSslReadExit,
  KprobeAccept4Entry, KretprobeAccept4Exit
- Add systemd-rpm-macros to all three RPM build stages (el8/el9/el10)
  so that %{_unitdir} macro resolves correctly
- RPMs now build successfully for el8, el9, el10

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

tests/integration/nginx/run-tests.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# =============================================================================
+# run-tests.sh — Tests d'intégration stack nginx + ja4ebpf
+#
+# Usage :
+#   ./run-tests.sh              # build + start + test + down
+#   ./run-tests.sh --no-down    # garder la stack après les tests
+#   ./run-tests.sh --build-only # build uniquement
+# =============================================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Variables de configuration pour la bibliothèque partagée
+export STACK_NAME="nginx"
+export COMPOSE_FILE="$SCRIPT_DIR/docker-compose.yml"
+
+for arg in "$@"; do
+    case "$arg" in
+        --no-down)    export KEEP_UP=true ;;
+        --build-only) export BUILD_ONLY=true ;;
+    esac
+done
+
+# Chargement de la bibliothèque commune
+source "$SCRIPT_DIR/../lib/run-stack-tests.sh"
+
+# ── Vérifications spécifiques nginx ──────────────────────────────────────────
+stack_verify_extra() {
+    # Vérifie que nginx répond avec le bon Server header
+    local server_hdr
+    server_hdr=$(docker compose -f "$COMPOSE_FILE" exec -T platform \
+        curl -skI https://localhost/ 2>/dev/null | grep -i "^Server:" | tr -d '\r' || echo "")
+    if echo "$server_hdr" | grep -qi "nginx"; then
+        pass "Header Server: nginx présent dans les réponses HTTPS"
+    else
+        warn "Header Server nginx non détecté (réponse: '$server_hdr')"
+    fi
+
+    # Vérifie HTTP/2 négocié (ALPN h2)
+    local alpn_result
+    alpn_result=$(docker compose -f "$COMPOSE_FILE" exec -T platform \
+        curl -sk --http2 -w "%{http_version}" -o /dev/null https://localhost/ 2>/dev/null || echo "")
+    if [ "$alpn_result" = "2" ]; then
+        pass "HTTP/2 négocié avec succès sur nginx (ALPN h2)"
+    else
+        warn "HTTP/2 non négocié (version: '$alpn_result') — vérifier la config TLS nginx"
+    fi
+
+    # Vérifie que ja4ebpf est bien en cours d'exécution
+    local ja4_running
+    ja4_running=$(docker compose -f "$COMPOSE_FILE" exec -T platform \
+        pgrep -x ja4ebpf 2>/dev/null | head -1 || echo "")
+    if [ -n "$ja4_running" ]; then
+        pass "Processus ja4ebpf actif (PID $ja4_running)"
+    else
+        fail "Processus ja4ebpf introuvable dans le conteneur platform"
+    fi
+
+    # Vérifie SNI capturé (ja4ebpf parse le ClientHello → extrait SNI)
+    local sni_count
+    sni_count=$(ch_query "SELECT count() FROM ja4_logs.http_logs_raw WHERE sni != ''")
+    if [ "${sni_count:-0}" -gt 0 ] 2>/dev/null; then
+        local sni_sample
+        sni_sample=$(ch_query "SELECT sni FROM ja4_logs.http_logs_raw WHERE sni != '' LIMIT 1")
+        pass "SNI capturé : $sni_count enregistrements (exemple : '$sni_sample')"
+    else
+        warn "Aucun SNI capturé (trafic TLS peut-être sans extension SNI)"
+    fi
+}
+
+# Lancement de tous les phases
+run_all_phases