Started the roadmap with incident grouping.

tests/test_incidents.py

@@ -0,0 +1,9 @@
+import unittest
+from fgai.incidents import build_incidents
+from fgai.models import AnomalyFinding
+
+class IncidentTests(unittest.TestCase):
+    def test_merges_anomaly_and_correlation(self):
+        anomaly = AnomalyFinding("10.0.0.1", 60, "high", "high", ["burst"], {})
+        result = build_incidents([anomaly], {"10.0.0.1": [{"score": 15, "reason": "new domain"}]}, [{"source_ip": "10.0.0.1", "streams": ["DNS", "Firewall"]}])
+        self.assertEqual(result[0]["score"], 85)