Formalize signals as first-class records separate from alerts

[jusso-dev]

Problem

Summary rules already create signal-like outputs in memory, but Tawny-SOC does not yet have persisted signal records. Without this layer, every important detection outcome tends to become an alert or disappear after recalculation.

Scope

Introduce persisted signals as the intermediate layer between normalized records and alerts. Detections, summary rules, UEBA behaviors, and correlation rules should be able to emit signals. Alert creation should be a separate policy decision.

Implementation Notes

• Add soc_signal table with tenantId, sourceRuleId, signalType, severity, confidence, entityKey, dedupeKey, recordIds, reasons, createdAt, firstSeenAt, and lastSeenAt.
• Add store functions for creating and listing signals.
• Update summary rule execution to optionally persist signals.
• Add a Signals tab or panel under Detections or Alerts.
• Add alert promotion logic that consumes signals based on severity, confidence, threshold, or policy.

Acceptance Criteria

• Summary rules can persist signals without creating alerts.
• Signals retain links to source records.
• Analysts can view recent signals and promote a signal to an alert/case.
• Signals are tenant-scoped and deduped by dedupeKey.
• Existing alert workflows continue to work.

Tests

• Unit test signal dedupe behavior.
• Unit test tenant-scoped signal listing.
• Unit test signal-to-alert promotion preserves evidence links.
• Regression test existing summary rules still produce expected in-memory results.