Add alert grouping, deduplication, and storm limiting

[jusso-dev]

Problem

Noisy rules can flood the alert queue. Tawny-SOC needs deterministic grouping and safety controls so repeated matches are appended to the right alert or converted into signals instead of creating endless alert rows.

Scope

Implement alert deduplication keys, grouping windows, event append behavior, and per-rule alert storm limits.

Implementation Notes

• Add detection metadata fields: dedupeWindowMinutes, dedupeFields, alertThreshold, stormLimitCount, stormLimitWindowMinutes.
• Compute dedupeKey from rule ID plus configured field values.
• When a matching open alert exists within the window, append event/signal references instead of creating a new alert.
• Add a groupedRecordCount or related table for alert evidence membership.
• If a rule exceeds the storm limit, disable alert creation for that rule and emit an operational system alert.
• Add UI indicators for grouped alerts and storm-limited rules.

Acceptance Criteria

• Repeated matches with the same dedupe key append to the existing alert.
• Repeated matches with different dedupe keys create separate alert groups.
• Storm-limited detections continue to emit signals but stop creating alerts.
• Analysts can see why an alert was grouped and how many records contributed.
• Operational alerts identify disabled or storm-limited detections.

Tests

• Unit test dedupe key generation from configured fields.
• Unit test grouping window behavior.
• Unit test storm limiter disables alert creation but preserves signals.
• UI test grouped alert count renders in alert list and detail.