fix: P0 audit bugs — bot-detector + dashboard + SQL

Bot-detector:
- B1.1: campaign_id and raw_anomaly_score now inserted into ml_detected_anomalies
- B1.4/B1.5: log_decision argument order fixed (cycle_id, name)
- B1.7: AE broadcast error — model now returns features list, scoring
  uses model's features instead of current cycle's (prevents dim mismatch)
- B1.8: Anubis ALLOW bots now get bot_name from anubis_bot_name

Dashboard:
- C1.1: XSS in ip_detail.html — {{ ip | tojson }} instead of raw string
- C1.2: Stored XSS via innerHTML — added escapeHtml() helper, all user-facing
  formatters (fmtIP, fmtASN, fmtCountry, fmtJA4, fmtBotName, fmtLabel) sanitized
- C2.1: status filter now correctly filters http_version column
- C2.2: heatmap toDayOfWeek() - 1 for 0-indexed JS days

SQL:
- B1.3: view_ip_recurrence worst_score uses max() not min() (0=normal, 1=anomal)
- B1.6: view_resource_cascade_1h joined into view_thesis_features_1h (§5.4)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

services/dashboard/backend/routes/api.py

@@ -314,7 +314,7 @@ async def traffic(
     order: str = Query("DESC"),
     method: str | None = Query(None),
     host: str | None = Query(None),
-    status: str | None = Query(None),
+    http_version: str | None = Query(None),
 ) -> dict[str, Any]:
     sort = _validate_sort(sort, _TRAFFIC_SORT_COLS, "time")
     order = _validate_order(order)
@@ -331,9 +331,9 @@ async def traffic(
         where_clauses.append("host LIKE {host:String}")
         params["host"] = f"%{host}%"
 
-    if status is not None:
-        where_clauses.append("http_version = {status:String}")
-        params["status"] = status
+    if http_version is not None:
+        where_clauses.append("http_version = {http_version:String}")
+        params["http_version"] = http_version
 
     where = " AND ".join(where_clauses)
 
@@ -651,7 +651,7 @@ async def behavior() -> dict[str, Any]:
 async def heatmap() -> dict[str, Any]:
     try:
         cells = query(
-            f"SELECT toDayOfWeek(time) AS dow, toHour(time) AS hour, count() AS cnt "
+            f"SELECT toDayOfWeek(time) - 1 AS dow, toHour(time) AS hour, count() AS cnt "
             f"FROM {_DB_LOGS}.http_logs "
             "WHERE time >= now() - INTERVAL 7 DAY "
             "GROUP BY dow, hour ORDER BY dow, hour"