feat: HTTP/2 passive fingerprinting with individual SETTINGS fields

Complete implementation of HTTP/2 passive fingerprinting per thesis §2.5.3:

mod-reqin-log (C module):
- Replace connection-level filter with ap_hook_process_connection (APR_HOOK_FIRST)
  to capture H2 preface before mod_http2 takes over the connection
- AP_MODE_SPECULATIVE read of 512 bytes from c->input_filters
- Parse SETTINGS, WINDOW_UPDATE, PRIORITY flags, pseudo-header order
- Output individual SETTINGS params as separate JSON fields (IDs 1-6, 8)
- Read H2 notes from c1 (master connection) for mod_http2 secondary conns
- Fix header_order_signature JSON length bug (26→strlen)

ClickHouse schema:
- Add 8 new columns to http_logs: h2_has_priority, h2_header_table_size,
  h2_enable_push, h2_max_concurrent_streams, h2_initial_window_size,
  h2_max_frame_size, h2_max_header_list_size, h2_enable_connect_protocol
- Use Int32/Int64 with DEFAULT -1 to distinguish absent vs zero
- Update mv_http_logs to extract individual fields via JSONHas/JSONExtractInt
- Migration 04_http2_fields.sql updated for existing deployments

Correlator:
- Accept both timestamp_ns and timestamp field names (backward compat)

Integration:
- Enable HTTP/2 in Apache: Protocols h2 http/1.1 in httpd-integration.conf

Validated end-to-end via Playwright: H2 curl traffic → mod-reqin-log →
correlator → ClickHouse with all 12 H2 columns populated correctly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

services/correlator/sql/migrations/04_http2_fields.sql

@@ -1,8 +1,8 @@
 -- === 04_http2_fields.sql — Ajout des colonnes HTTP/2 à http_logs ===
 --
--- Migration pour les déploiements existants : ajoute les 4 colonnes de
--- fingerprint HTTP/2 passif extraites par mod_reqin_log via son filtre
--- de connexion (APR_HOOK_LAST, AP_FTYPE_CONNECTION).
+-- Migration pour les déploiements existants : ajoute les colonnes de
+-- fingerprint HTTP/2 passif extraites par mod_reqin_log via son hook
+-- process_connection (APR_HOOK_FIRST, AP_MODE_SPECULATIVE).
 --
 -- Format du fingerprint Akamai (h2_fingerprint) :
 --   Chrome  : "1:65536,2:0,4:6291456,6:262144|15663105|0|m,a,s,p"
@@ -12,6 +12,7 @@
 -- Appliquer avec :
 --   clickhouse-client --multiquery < 04_http2_fields.sql
 
+-- Champs composites (fingerprint global + valeurs agrégées)
 ALTER TABLE ja4_logs.http_logs
     ADD COLUMN IF NOT EXISTS `h2_fingerprint`   String DEFAULT '' CODEC(ZSTD(3));
 
@@ -23,3 +24,29 @@ ALTER TABLE ja4_logs.http_logs
 
 ALTER TABLE ja4_logs.http_logs
     ADD COLUMN IF NOT EXISTS `h2_pseudo_order`  LowCardinality(String) DEFAULT '';
+
+ALTER TABLE ja4_logs.http_logs
+    ADD COLUMN IF NOT EXISTS `h2_has_priority`  UInt8 DEFAULT 0;
+
+-- Paramètres SETTINGS individuels (RFC 9113 §6.5.2)
+-- Valeur -1 = paramètre absent du preface client (non envoyé)
+ALTER TABLE ja4_logs.http_logs
+    ADD COLUMN IF NOT EXISTS `h2_header_table_size`       Int32 DEFAULT -1;
+
+ALTER TABLE ja4_logs.http_logs
+    ADD COLUMN IF NOT EXISTS `h2_enable_push`             Int32 DEFAULT -1;
+
+ALTER TABLE ja4_logs.http_logs
+    ADD COLUMN IF NOT EXISTS `h2_max_concurrent_streams`  Int32 DEFAULT -1;
+
+ALTER TABLE ja4_logs.http_logs
+    ADD COLUMN IF NOT EXISTS `h2_initial_window_size`     Int64 DEFAULT -1;
+
+ALTER TABLE ja4_logs.http_logs
+    ADD COLUMN IF NOT EXISTS `h2_max_frame_size`          Int32 DEFAULT -1;
+
+ALTER TABLE ja4_logs.http_logs
+    ADD COLUMN IF NOT EXISTS `h2_max_header_list_size`    Int32 DEFAULT -1;
+
+ALTER TABLE ja4_logs.http_logs
+    ADD COLUMN IF NOT EXISTS `h2_enable_connect_protocol` Int32 DEFAULT -1;