add rule generalization, sized LLM defaults, ops docs, and UI polish

Feedback rules can now be suggested for merging when a human has already
reviewed the same pattern multiple times (never guesses about new values).
LLM defaults sized for constrained VRAM instead of llama3.3/llama3.1.
Adds systemd units, a state backup script, and reverse-proxy auth guidance
for production deployment. Findings view is collapsible and sorts
suggested-review rows to the top for a quicker overview.

systemd/signalscope-dashboard.service

@@ -0,0 +1,29 @@
+[Unit]
+Description=SignalScope dashboard
+After=network-online.target signalscope-monitor.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=signalscope
+Group=signalscope
+WorkingDirectory=/opt/signalscope
+# Binds to loopback only by default. Do not change --host to 0.0.0.0 without
+# putting an authenticating reverse proxy in front — see the README section
+# "Exposing the dashboard beyond loopback".
+ExecStart=/opt/signalscope/.venv/bin/fgai dashboard \
+    --host 127.0.0.1 \
+    --port 8088 \
+    --status-file /opt/signalscope/state/fgai-status.json \
+    --config-file /opt/signalscope/state/fgai-config.json \
+    --image-dir /opt/signalscope/images
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/signalscope/state
+
+[Install]
+WantedBy=multi-user.target