fix(waf): CRS v4 Regeln extrahiert + Control-Flow-Regeln filtern — v1.2.82

- crsRules.ts neu: 331 echte CRS v4.7.0 Regeln aus installierten Dateien
  (v3-Nummernschema war falsch, v4 hat andere IDs — 949152 war skip-Regel)
- spoe.go: Regeln ohne Message nicht als Alert speichern

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/waf/spoe.go

@@ -132,10 +132,17 @@ func (a *SPOEAgent) handle(ctx context.Context, w *encoding.ActionWriter, m *enc
 }
 
 // sendAlert enqueues a WAF alert for async DB write.
+// Control-flow rules (pass+nolog with empty message) are skipped —
+// they are CRS paranoia-level skip-markers, not real detections.
 func (a *SPOEAgent) sendAlert(host, clientIP, method, uri string, mr types.MatchedRule, blocked bool) {
 	if a.AlertWriter == nil {
 		return
 	}
+	// Skip rules with no message — these are CRS skip/control-flow rules
+	// (e.g. 949011..949018, 911011..911018) that match but carry no alert info.
+	if mr.Message() == "" && mr.Rule().ID() > 0 {
+		return
+	}
 	action := "detected"
 	if blocked && mr.Disruptive() {
 		action = "blocked"