fix(waf): Setup-Regeln (900xxx–909xxx) nicht als Alerts speichern — v1.2.83

CRS 900xxx/901xxx (init, body inspection, paranoia setup) feuern auf
JEDEM Request — keine Security-Events. Filter: nur rule_id >= 910000
wird als Alert in DB geschrieben. Buffer 512 → 2048.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/waf/spoe.go

@@ -138,9 +138,15 @@ func (a *SPOEAgent) sendAlert(host, clientIP, method, uri string, mr types.Match
 	if a.AlertWriter == nil {
 		return
 	}
-	// Skip rules with no message — these are CRS skip/control-flow rules
-	// (e.g. 949011..949018, 911011..911018) that match but carry no alert info.
-	if mr.Message() == "" && mr.Rule().ID() > 0 {
+	ruleID := mr.Rule().ID()
+	// Skip CRS setup/initialization rules (900xxx–909xxx) — they fire on
+	// every request as part of CRS init and are not security events.
+	// Real detection rules start at 910xxx (IP reputation) and above.
+	if ruleID > 0 && ruleID < 910000 {
+		return
+	}
+	// Skip control-flow rules with no message (PL-skip markers).
+	if mr.Message() == "" {
 		return
 	}
 	action := "detected"