add rule generalization, sized LLM defaults, ops docs, and UI polish

Feedback rules can now be suggested for merging when a human has already
reviewed the same pattern multiple times (never guesses about new values).
LLM defaults sized for constrained VRAM instead of llama3.3/llama3.1.
Adds systemd units, a state backup script, and reverse-proxy auth guidance
for production deployment. Findings view is collapsible and sorts
suggested-review rows to the top for a quicker overview.

systemd/README.md

@@ -0,0 +1,68 @@
+# Running SignalScope under systemd
+
+These units replace `start.sh`/`stop.sh` with proper service supervision
+(auto-restart, journald logging, boot-time start). They assume the repo lives
+at `/opt/signalscope` and runs as a dedicated `signalscope` user — adjust the
+paths and `User=`/`Group=` lines if you deploy elsewhere.
+
+## One-time setup
+
+```bash
+sudo useradd --system --home-dir /opt/signalscope --shell /usr/sbin/nologin signalscope
+sudo mkdir -p /opt/signalscope
+sudo cp -r . /opt/signalscope/          # from a checkout of this repo
+sudo chown -R signalscope:signalscope /opt/signalscope
+
+# Create the venv and install dependencies as the service user
+sudo -u signalscope python3 -m venv /opt/signalscope/.venv
+sudo -u signalscope /opt/signalscope/.venv/bin/pip install --upgrade pip
+sudo -u signalscope /opt/signalscope/.venv/bin/pip install -e /opt/signalscope
+
+sudo cp systemd/*.service /etc/systemd/system/
+sudo systemctl daemon-reload
+```
+
+## Enable and start
+
+```bash
+sudo systemctl enable --now signalscope-monitor.service
+sudo systemctl enable --now signalscope-dashboard.service
+
+# Only if you use the local syslog input instead of Graylog MCP:
+sudo systemctl enable --now signalscope-syslog.service
+```
+
+## Everyday operations
+
+```bash
+systemctl status signalscope-monitor signalscope-dashboard
+journalctl -u signalscope-monitor -f
+journalctl -u signalscope-dashboard -f
+sudo systemctl restart signalscope-monitor signalscope-dashboard
+```
+
+Configure Graylog MCP, streams, and profiles the same way as always: open the
+dashboard and use Settings — configuration lives in
+`/opt/signalscope/state/fgai-config.json` regardless of how the process was
+started.
+
+## Updating
+
+```bash
+sudo systemctl stop signalscope-dashboard signalscope-monitor
+sudo -u signalscope git -C /opt/signalscope pull
+sudo -u signalscope /opt/signalscope/.venv/bin/pip install -e /opt/signalscope
+sudo systemctl start signalscope-monitor signalscope-dashboard
+```
+
+## Notes
+
+- `signalscope-dashboard.service` binds `127.0.0.1` by default, matching the
+  documented safety default in the main README. See "Exposing the dashboard
+  beyond loopback" there before changing `--host` to anything else.
+- `state/` (config, feedback rules, baselines, incidents) is the only
+  directory that needs backing up — see `scripts/backup_state.sh` and the
+  "Backup and Restore" section in the main README.
+- The monitor unit's `ExecStart` has a commented example for enabling the
+  Ollama dashboard assessment (`--llm ...`); the profile advisor is a
+  dashboard Settings toggle and needs no unit-file change.