feat: HTTP/2 passive fingerprinting with individual SETTINGS fields

Complete implementation of HTTP/2 passive fingerprinting per thesis §2.5.3:

mod-reqin-log (C module):
- Replace connection-level filter with ap_hook_process_connection (APR_HOOK_FIRST)
  to capture H2 preface before mod_http2 takes over the connection
- AP_MODE_SPECULATIVE read of 512 bytes from c->input_filters
- Parse SETTINGS, WINDOW_UPDATE, PRIORITY flags, pseudo-header order
- Output individual SETTINGS params as separate JSON fields (IDs 1-6, 8)
- Read H2 notes from c1 (master connection) for mod_http2 secondary conns
- Fix header_order_signature JSON length bug (26→strlen)

ClickHouse schema:
- Add 8 new columns to http_logs: h2_has_priority, h2_header_table_size,
  h2_enable_push, h2_max_concurrent_streams, h2_initial_window_size,
  h2_max_frame_size, h2_max_header_list_size, h2_enable_connect_protocol
- Use Int32/Int64 with DEFAULT -1 to distinguish absent vs zero
- Update mv_http_logs to extract individual fields via JSONHas/JSONExtractInt
- Migration 04_http2_fields.sql updated for existing deployments

Correlator:
- Accept both timestamp_ns and timestamp field names (backward compat)

Integration:
- Enable HTTP/2 in Apache: Protocols h2 http/1.1 in httpd-integration.conf

Validated end-to-end via Playwright: H2 curl traffic → mod-reqin-log →
correlator → ClickHouse with all 12 H2 columns populated correctly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

services/sentinel/api/types.go

@@ -42,6 +42,7 @@ type TCPMeta struct {
 	MSS         uint16   `json:"mss,omitempty"`
 	WindowScale uint8    `json:"window_scale,omitempty"`
 	Options     []string `json:"options"`
+	OptionKinds []uint8  `json:"-"` // Raw TCP option kind numbers for JA4T
 }
 
 // RawPacket represents a raw packet captured from the network
@@ -73,6 +74,7 @@ type TLSClientHello struct {
 type Fingerprints struct {
 	JA4     string `json:"ja4"`
 	JA4Hash string `json:"ja4_hash,omitempty"` // Internal use, not serialized to LogRecord
+	JA4T    string `json:"ja4t,omitempty"`
 	JA3     string `json:"ja3,omitempty"`
 	JA3Hash string `json:"ja3_hash,omitempty"`
 }
@@ -111,6 +113,7 @@ type LogRecord struct {
 	// Fingerprints
 	// Note: ja4_hash is NOT included - the JA4 format already includes its own hash portions
 	JA4     string `json:"ja4"`
+	JA4T    string `json:"ja4t,omitempty"`
 	JA3     string `json:"ja3,omitempty"`
 	JA3Hash string `json:"ja3_hash,omitempty"`
 
@@ -265,6 +268,7 @@ func NewLogRecord(ch TLSClientHello, fp *Fingerprints) LogRecord {
 
 	if fp != nil {
 		rec.JA4 = fp.JA4
+		rec.JA4T = fp.JA4T
 		rec.JA3 = fp.JA3
 		rec.JA3Hash = fp.JA3Hash
 	}