Feat: Détection menaces HTTP via vues ClickHouse + simplification shutdown

Nouvelles vues de détection (sql/views.sql) :
- Identification hosts par IP/JA4 (view_host_identification, view_host_ja4_anomalies)
- Détection brute force POST et query params variables
- Header fingerprinting (ordre, headers modernes manquants, Sec-CH-UA)
- ALPN mismatch detection (h2 déclaré mais HTTP/1.1 parlé)
- Rate limiting & burst detection (50 req/min, 20 req/10s)
- Path enumeration/scanning (paths sensibles)
- Payload attacks (SQLi, XSS, path traversal)
- JA4 botnet detection (même fingerprint sur 20+ IPs)
- Correlation quality (orphan ratio >80%)

ClickHouse (sql/init.sql) :
- Compression ZSTD(3) sur champs texte (path, query, headers, ja3/ja4)
- TTL automatique : 1 jour (raw) + 7 jours (http_logs)
- Paramètre ttl_only_drop_parts = 1

Shutdown simplifié (internal/app/orchestrator.go) :
- Suppression ShutdownTimeout et logique de flush/attente
- Stop() = cancel() + Close() uniquement
- systemd TimeoutStopSec gère l'arrêt forcé si besoin

File output toggle (internal/config/*.go) :
- Ajout champ Enabled dans FileOutputConfig
- Le sink fichier n'est créé que si enabled && path != ''
- Tests : TestValidate_FileOutputDisabled, TestLoadConfig_FileOutputDisabled

RPM packaging (packaging/rpm/logcorrelator.spec) :
- Changelog 1.1.18 → 1.1.22
- Suppression logcorrelator-tmpfiles.conf (redondant RuntimeDirectory=)

Nettoyage :
- idees.txt → idees/ (dossier)
- Suppression 91.224.92.185.txt (logs exemple)

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

internal/config/config.go

@@ -69,7 +69,8 @@ type OutputsConfig struct {
 
 // FileOutputConfig holds file sink configuration.
 type FileOutputConfig struct {
-	Path string `yaml:"path"`
+	Enabled bool   `yaml:"enabled"`
+	Path    string `yaml:"path"`
 }
 
 // ClickHouseOutputConfig holds ClickHouse sink configuration.
@@ -182,7 +183,8 @@ func defaultConfig() *Config {
 		},
 		Outputs: OutputsConfig{
 			File: FileOutputConfig{
-				Path: "/var/log/logcorrelator/correlated.log",
+				Enabled: true,
+				Path:    "/var/log/logcorrelator/correlated.log",
 			},
 			ClickHouse: ClickHouseOutputConfig{
 				Enabled:         false,
@@ -232,7 +234,7 @@ func (c *Config) Validate() error {
 
 	// At least one output must be enabled
 	hasOutput := false
-	if c.Outputs.File.Path != "" {
+	if c.Outputs.File.Enabled && c.Outputs.File.Path != "" {
 		hasOutput = true
 	}
 	if c.Outputs.ClickHouse.Enabled {