feat(ml): replace Autoencoder with RealNVP Normalizing Flow and add SessionTransformer embeddings

Replace TrafficAutoEncoder (MSE reconstruction scoring) with TrafficNormalizingFlow
(RealNVP via FrEIA, 4 affine coupling blocks, anomaly score = -log p(x)) for
mathematically rigorous density estimation. Add SessionTransformer module producing
32-dimensional sequence embeddings from raw HTTP request sequences (path, method,
timing) via a lightweight TransformerEncoder, replacing path_transition_entropy and
cadence_cv features. Update thesis documentation sections 2.4.2b and 3.8 accordingly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

services/bot-detector/bot_detector/preprocessing.py

@@ -37,10 +37,12 @@ FEATURES = [
     'axis_nav_behavior', 'axis_tls_coherence', 'axis_h2_coherence',
     # HTTP
     'missing_accept_enc_ratio', 'http_scheme_ratio',
-    # Thèse §5
-    'path_transition_entropy',
-    'cadence_cv', 'burst_ratio', 'pause_ratio',
+    # Thèse §5 — timing (burst_ratio, pause_ratio, lag1_autocorrelation, benford_deviation)
+    # path_transition_entropy et cadence_cv remplacés par embeddings Transformer
+    'burst_ratio', 'pause_ratio',
     'lag1_autocorrelation', 'benford_deviation',
+    # §5.2 — Session Transformer embeddings (remplace path_transition_entropy + cadence_cv)
+    *[f'seq_emb_{i}' for i in range(32)],
     'host_diversity', 'host_sweep_speed', 'host_coverage_uniformity',
     # §5.8b — Similarité Jaccard cross-domaine (chemins partagés entre hosts)
     'cross_domain_path_similarity',