add rule generalization, sized LLM defaults, ops docs, and UI polish

Feedback rules can now be suggested for merging when a human has already
reviewed the same pattern multiple times (never guesses about new values).
LLM defaults sized for constrained VRAM instead of llama3.3/llama3.1.
Adds systemd units, a state backup script, and reverse-proxy auth guidance
for production deployment. Findings view is collapsible and sorts
suggested-review rows to the top for a quicker overview.

systemd/README.md

@@ -0,0 +1,68 @@
+# Running SignalScope under systemd
+
+These units replace `start.sh`/`stop.sh` with proper service supervision
+(auto-restart, journald logging, boot-time start). They assume the repo lives
+at `/opt/signalscope` and runs as a dedicated `signalscope` user — adjust the
+paths and `User=`/`Group=` lines if you deploy elsewhere.
+
+## One-time setup
+
+```bash
+sudo useradd --system --home-dir /opt/signalscope --shell /usr/sbin/nologin signalscope
+sudo mkdir -p /opt/signalscope
+sudo cp -r . /opt/signalscope/          # from a checkout of this repo
+sudo chown -R signalscope:signalscope /opt/signalscope
+
+# Create the venv and install dependencies as the service user
+sudo -u signalscope python3 -m venv /opt/signalscope/.venv
+sudo -u signalscope /opt/signalscope/.venv/bin/pip install --upgrade pip
+sudo -u signalscope /opt/signalscope/.venv/bin/pip install -e /opt/signalscope
+
+sudo cp systemd/*.service /etc/systemd/system/
+sudo systemctl daemon-reload
+```
+
+## Enable and start
+
+```bash
+sudo systemctl enable --now signalscope-monitor.service
+sudo systemctl enable --now signalscope-dashboard.service
+
+# Only if you use the local syslog input instead of Graylog MCP:
+sudo systemctl enable --now signalscope-syslog.service
+```
+
+## Everyday operations
+
+```bash
+systemctl status signalscope-monitor signalscope-dashboard
+journalctl -u signalscope-monitor -f
+journalctl -u signalscope-dashboard -f
+sudo systemctl restart signalscope-monitor signalscope-dashboard
+```
+
+Configure Graylog MCP, streams, and profiles the same way as always: open the
+dashboard and use Settings — configuration lives in
+`/opt/signalscope/state/fgai-config.json` regardless of how the process was
+started.
+
+## Updating
+
+```bash
+sudo systemctl stop signalscope-dashboard signalscope-monitor
+sudo -u signalscope git -C /opt/signalscope pull
+sudo -u signalscope /opt/signalscope/.venv/bin/pip install -e /opt/signalscope
+sudo systemctl start signalscope-monitor signalscope-dashboard
+```
+
+## Notes
+
+- `signalscope-dashboard.service` binds `127.0.0.1` by default, matching the
+  documented safety default in the main README. See "Exposing the dashboard
+  beyond loopback" there before changing `--host` to anything else.
+- `state/` (config, feedback rules, baselines, incidents) is the only
+  directory that needs backing up — see `scripts/backup_state.sh` and the
+  "Backup and Restore" section in the main README.
+- The monitor unit's `ExecStart` has a commented example for enabling the
+  Ollama dashboard assessment (`--llm ...`); the profile advisor is a
+  dashboard Settings toggle and needs no unit-file change.

systemd/signalscope-dashboard.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=SignalScope dashboard
+After=network-online.target signalscope-monitor.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=signalscope
+Group=signalscope
+WorkingDirectory=/opt/signalscope
+# Binds to loopback only by default. Do not change --host to 0.0.0.0 without
+# putting an authenticating reverse proxy in front — see the README section
+# "Exposing the dashboard beyond loopback".
+ExecStart=/opt/signalscope/.venv/bin/fgai dashboard \
+    --host 127.0.0.1 \
+    --port 8088 \
+    --status-file /opt/signalscope/state/fgai-status.json \
+    --config-file /opt/signalscope/state/fgai-config.json \
+    --image-dir /opt/signalscope/images
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/signalscope/state
+
+[Install]
+WantedBy=multi-user.target

systemd/signalscope-monitor.service

@@ -0,0 +1,30 @@
+[Unit]
+Description=SignalScope continuous monitor
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=signalscope
+Group=signalscope
+WorkingDirectory=/opt/signalscope
+# To enable the local Ollama dashboard assessment, add to ExecStart below:
+#   --llm --llm-interval 300 --llm-timeout 180 --model qwen2.5:7b-instruct
+ExecStart=/opt/signalscope/.venv/bin/fgai monitor \
+    --logs /opt/signalscope/logs/fg_syslog.jsonl \
+    --output /opt/signalscope/state/fgai-status.json \
+    --interval 10 \
+    --baseline-db /opt/signalscope/state/fgai-baseline.sqlite3 \
+    --history-db /opt/signalscope/state/signalscope-history.sqlite3 \
+    --status-cache-db /opt/signalscope/state/signalscope-status-cache.sqlite3 \
+    --config-file /opt/signalscope/state/fgai-config.json
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/signalscope/state /opt/signalscope/logs /opt/signalscope/run
+
+[Install]
+WantedBy=multi-user.target

systemd/signalscope-syslog.service

@@ -0,0 +1,30 @@
+[Unit]
+Description=SignalScope local syslog listener (optional — only needed for the local_syslog log source, not for Graylog MCP)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=signalscope
+Group=signalscope
+WorkingDirectory=/opt/signalscope
+ExecStart=/opt/signalscope/.venv/bin/fgai listen-syslog \
+    --host 0.0.0.0 \
+    --port 5514 \
+    --output /opt/signalscope/logs/fg_syslog.jsonl \
+    --rotate-bytes 26214400 \
+    --rotate-count 14 \
+    --quiet
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/signalscope/logs
+# To listen on the standard syslog port 514 instead of 5514, change --port
+# above to 514 and uncomment the line below instead of running as root:
+# AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target