fix: architecture violations and pre-existing test bugs

- Remove JA4SENTINEL_LOG_LEVEL env override (architecture violation: log_level must be YAML-only)
- Add TestLoadFromEnv_LogLevelIgnored test to verify env var is ignored
- Fix yaml struct tags in api.Config/AppConfig/OutputConfig (yaml.v3 ignores json tags)
- Fix isValidIP/isValidCIDR to use net.ParseIP/net.ParseCIDR for proper validation
- Fix SLL packet parsing: use protoType from SLL header to select IPv4/IPv6 decoder
- Fix TestLoadFromFile_ExcludeSourceIPs: t.Errorf → t.Fatalf to avoid nil dereference
- Fix TestFromClientHello_NilPayload: use strings.HasPrefix for error message check
- Fix TestValidate_ExcludeSourceIPs: add required FlowTimeoutSec/PacketBufferSize defaults

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

internal/fingerprint/engine_test.go

@@ -1,6 +1,7 @@
 package fingerprint
 
 import (
+	"strings"
 	"testing"
 
 	"ja4sentinel/api"
@@ -195,8 +196,8 @@ func TestFromClientHello_NilPayload(t *testing.T) {
 	if err == nil {
 		t.Error("FromClientHello() with nil payload should return error")
 	}
-	if err.Error() != "empty ClientHello payload" {
-		t.Errorf("FromClientHello() error = %v, want 'empty ClientHello payload'", err)
+	if !strings.HasPrefix(err.Error(), "empty ClientHello payload") {
+		t.Errorf("FromClientHello() error = %v, should start with 'empty ClientHello payload'", err)
 	}
 }