add rule generalization, sized LLM defaults, ops docs, and UI polish

Feedback rules can now be suggested for merging when a human has already
reviewed the same pattern multiple times (never guesses about new values).
LLM defaults sized for constrained VRAM instead of llama3.3/llama3.1.
Adds systemd units, a state backup script, and reverse-proxy auth guidance
for production deployment. Findings view is collapsible and sorts
suggested-review rows to the top for a quicker overview.

src/fgai/monitor.py

@@ -12,7 +12,7 @@ from .baseline import BaselineStore
 from .config import ConfigStore
 from .correlation import correlate_source_ips
 from .event_context import build_event_context
-from .feedback import FeedbackStore, SUPPRESSING_STATUSES, feedback_matches, select_match
+from .feedback import FeedbackStore, SUPPRESSING_STATUSES, feedback_matches, select_match, suggest_generalizations
 from .graylog_aggregate import GraylogAggregateSource
 from .graylog_mcp import GraylogMcpClient
 from .graylog_source import GraylogStreamSource
@@ -524,6 +524,8 @@ def build_status(
                 deviation["feedback_rule_id"] = match.get("id", "")
                 if match["status"] in SUPPRESSING_STATUSES:
                     deviation["score"] = 0
+    generalization_min_values = int(runtime_values.get("feedback_generalization_min_values", 3) or 3)
+    feedback_generalization_suggestions = suggest_generalizations(feedback, min_values=generalization_min_values)
     anomalies = detect_source_anomalies(events, limit=anomaly_limit, baselines=profiles, field_deviations=field_deviations)
     baseline_events = baseline.ingest(events) if baseline else 0
     profile_baseline_fields = (
@@ -691,6 +693,7 @@ def build_status(
         "triage_queue": triage_queue,
         "sequence_findings": sequence_findings,
         "feedback": feedback,
+        "feedback_generalization_suggestions": feedback_generalization_suggestions,
         "cross_source_correlations": correlations,
         "incidents": incidents,
         "data_quality": assess_data_quality(events, mcp_status),