add feedback scopes, revoke and precision metrics

Feedback rules now support value/field/entity/stream scope, require
expiry for broad suppressions, and can be revoked individually.
Adds an active-rules panel, detector precision metrics, and diagnostics.

src/fgai/monitor.py

@@ -12,7 +12,7 @@ from .baseline import BaselineStore
 from .config import ConfigStore
 from .correlation import correlate_source_ips
 from .event_context import build_event_context
-from .feedback import FeedbackStore
+from .feedback import FeedbackStore, SUPPRESSING_STATUSES, feedback_matches, select_match
 from .graylog_aggregate import GraylogAggregateSource
 from .graylog_mcp import GraylogMcpClient
 from .graylog_source import GraylogStreamSource
@@ -383,16 +383,18 @@ def build_status(
     feedback = FeedbackStore().entries()
     for entity, deviations in field_deviations.items():
         for deviation in deviations:
-            match = next((
+            stream_id = str(deviation.get("stream_id", ""))
+            field = str(deviation.get("field", ""))
+            value = str(deviation.get("value", ""))
+            candidates = [
                 item for item in feedback
-                if item.get("entity") == entity
-                and item.get("stream_id") == deviation.get("stream_id")
-                and item.get("field") == deviation.get("field")
-                and (not item.get("value") or item.get("value") == deviation.get("value", ""))
-            ), None)
-            if match:
+                if feedback_matches(item, entity=entity, stream_id=stream_id, field=field, value=value)
+            ]
+            if candidates:
+                match = select_match(candidates)
                 deviation["feedback"] = match["status"]
-                if match["status"] in {"false_positive", "expected"}:
+                deviation["feedback_rule_id"] = match.get("id", "")
+                if match["status"] in SUPPRESSING_STATUSES:
                     deviation["score"] = 0
     anomalies = detect_source_anomalies(events, limit=anomaly_limit, baselines=profiles, field_deviations=field_deviations)
     baseline_events = baseline.ingest(events) if baseline else 0