add rule generalization, sized LLM defaults, ops docs, and UI polish

Feedback rules can now be suggested for merging when a human has already
reviewed the same pattern multiple times (never guesses about new values).
LLM defaults sized for constrained VRAM instead of llama3.3/llama3.1.
Adds systemd units, a state backup script, and reverse-proxy auth guidance
for production deployment. Findings view is collapsible and sorts
suggested-review rows to the top for a quicker overview.

systemd/signalscope-syslog.service

@@ -0,0 +1,30 @@
+[Unit]
+Description=SignalScope local syslog listener (optional — only needed for the local_syslog log source, not for Graylog MCP)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=signalscope
+Group=signalscope
+WorkingDirectory=/opt/signalscope
+ExecStart=/opt/signalscope/.venv/bin/fgai listen-syslog \
+    --host 0.0.0.0 \
+    --port 5514 \
+    --output /opt/signalscope/logs/fg_syslog.jsonl \
+    --rotate-bytes 26214400 \
+    --rotate-count 14 \
+    --quiet
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/opt/signalscope/logs
+# To listen on the standard syslog port 514 instead of 5514, change --port
+# above to 514 and uncomment the line below instead of running as root:
+# AmbientCapabilities=CAP_NET_BIND_SERVICE
+
+[Install]
+WantedBy=multi-user.target