[codex] Add SentinelBlue foundation, detectors, and cases

[ksjpswaroop]

Summary

Adds the SentinelBlue local AI security monitoring product foundation, completes MVP event normalization, adds the deterministic detector engine, and implements the alert-to-case workflow.

Included work:

• Production-readiness docs and development tracker
• Rust workspace, server crate, SQLite persistence, skill indexing, and DB-backed read APIs
• JSON/JSONL raw event import with dedupe hashes
• Wazuh, Sysmon, Zeek DNS/connection, Suricata EVE, API gateway, and identity/authentication JSON normalization
• Normalized event storage that preserves raw evidence linkage
• Deterministic detector crate with the initial detector family: suspicious PowerShell, Sysmon process injection, password spray, impossible travel, DNS tunneling, DNS beaconing, API enumeration, and IOC match
• Detector run persistence, detector-created alerts, ATT&CK mapping JSON, alert descriptions, and evidence links
• Alert-to-case promotion, case timeline, analyst notes, and close-case workflow requiring disposition plus notes
• sentinel-server --run-detectors, --promote-alert, and --close-case operator commands
• Web API client and read-only dashboard consumption

Validation

• cargo fmt --all
• cargo test
• npm run build
• CLI smoke: import Wazuh sample, run detectors, promote alert to case, close case with disposition and notes

Notes

Direct push to mukul975/Anthropic-Cybersecurity-Skills was denied for the authenticated GitHub account, so this branch is pushed to the ksjpswaroop fork and opened as a draft PR back to main.