feat(waf): Alerts — Regelübereinstimmungen in DB + UI — v1.2.77

- Migration 0038: waf_alerts-Tabelle
- AlertWriter (Buffered-Channel → async DB-Write)
- SPOE: MatchedRules → sendAlert() nach ProcessRequestHeaders()
- API: GET /waf/alerts + DELETE /waf/alerts
- WAF-Page: Tabs Domains | Alarme; Alarme-Tabelle mit Rule-ID,
  Severity, Aktion (Detected/Blocked), URI, Client-IP + Purge-Button

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/handlers/waf.go

@@ -36,6 +36,8 @@ func (h *WafHandler) Register(rg *gin.RouterGroup) {
 	g.GET("/configs", h.List)
 	g.GET("/configs/:domain_id", h.Get)
 	g.PUT("/configs/:domain_id", h.Upsert)
+	g.GET("/alerts", h.ListAlerts)
+	g.DELETE("/alerts", h.PurgeAlerts)
 }
 
 // List returns all WAF configs.
@@ -134,6 +136,48 @@ func (h *WafHandler) Upsert(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"config": result})
 }
 
+// ListAlerts returns recent WAF alerts. Optional: ?domain_id=X&limit=N
+func (h *WafHandler) ListAlerts(c *gin.Context) {
+	var domainID *int64
+	if v := c.Query("domain_id"); v != "" {
+		id, err := strconv.ParseInt(v, 10, 64)
+		if err != nil {
+			response.BadRequest(c, errors.New("invalid domain_id"))
+			return
+		}
+		domainID = &id
+	}
+	limit := 200
+	if v := c.Query("limit"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			limit = n
+		}
+	}
+	alerts, err := h.Repo.ListAlerts(c.Request.Context(), domainID, limit)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	response.OK(c, gin.H{"alerts": alerts})
+}
+
+// PurgeAlerts deletes old WAF alerts. Optional: ?days=N (default 30)
+func (h *WafHandler) PurgeAlerts(c *gin.Context) {
+	days := 30
+	if v := c.Query("days"); v != "" {
+		if n, err := strconv.Atoi(v); err == nil && n > 0 {
+			days = n
+		}
+	}
+	if err := h.Repo.PurgeAlerts(c.Request.Context(), days); err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "waf.alerts.purge",
+		"", gin.H{"days": days}, h.NodeID)
+	response.OK(c, gin.H{"ok": true, "days": days})
+}
+
 // defaultConfig returns a sensible disabled default for a domain
 // that has no WAF config row yet.
 func defaultConfig(domainID int64) models.WafConfig {