feat(waf): Alerts — Regelübereinstimmungen in DB + UI — v1.2.77

- Migration 0038: waf_alerts-Tabelle
- AlertWriter (Buffered-Channel → async DB-Write)
- SPOE: MatchedRules → sendAlert() nach ProcessRequestHeaders()
- API: GET /waf/alerts + DELETE /waf/alerts
- WAF-Page: Tabs Domains | Alarme; Alarme-Tabelle mit Rule-ID,
  Severity, Aktion (Detected/Blocked), URI, Client-IP + Purge-Button

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/edgeguard-waf/main.go

@@ -70,9 +70,12 @@ func main() {
 		}
 	}()
 
+	alertWriter := intwaf.NewAlertWriter(pool, 512)
+
 	agent := intwaf.SPOEAgent{
-		Manager: mgr,
-		Addr:    spoeAddr,
+		Manager:     mgr,
+		AlertWriter: alertWriter,
+		Addr:        spoeAddr,
 	}
 
 	slog.Info("waf: SPOE agent starting", "addr", spoeAddr, "crs", crsDir)