feat: CrowdSec journald-Acquisition + Alarm-Quittieren/Löschen — v1.3.5

- fix(crowdsec/packaging): postinst setzt die HAProxy-Acquisition deterministisch
  auf die journald-Unit (haproxy.service) statt der cscli-setup-Datei-Default
  (/var/log/haproxy.log existiert nicht → CrowdSec las nichts → HTTP/CVE-Szenarien
  liefen leer). Self-healing auf jedem configure; admin-Custom bleibt unangetastet.
- feat(alerts): Alarme (alert_events) bulk quittieren + löschen. Migration 0045
  (acknowledged_at + Teil-Index). Dashboard-Karte zählt nur noch OFFENE (open=true)
  → Quittieren lässt die "Aktuelle Alerts"-Meldung verschwinden, History bleibt.
  Events-Tab: Row-Selection, Quittieren/Löschen (Auswahl) + "Alle quittieren",
  Status-Spalte (offen/quittiert). Audit-geloggt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/handlers/alerts.go

@@ -18,7 +18,10 @@ import (
 //	PUT    /api/v1/alerts/channels/:id
 //	DELETE /api/v1/alerts/channels/:id
 //	POST   /api/v1/alerts/test           — Test-Event in alle aktiven Channels
-//	GET    /api/v1/alerts/events?limit=N — History
+//	GET    /api/v1/alerts/events?limit=N&open=true — History (open=nur offene)
+//	POST   /api/v1/alerts/events/acknowledge      — Bulk-Quittieren {ids:[…]}
+//	POST   /api/v1/alerts/events/acknowledge-all  — alle offenen quittieren
+//	POST   /api/v1/alerts/events/delete           — Bulk-Löschen {ids:[…]}
 type AlertsHandler struct {
 	Service *alerts.Service
 	Audit   *audit.Repo
@@ -37,6 +40,9 @@ func (h *AlertsHandler) Register(rg *gin.RouterGroup) {
 	g.DELETE("/channels/:id", h.DeleteChannel)
 	g.POST("/test", h.TestFire)
 	g.GET("/events", h.ListEvents)
+	g.POST("/events/acknowledge", h.AcknowledgeEvents)
+	g.POST("/events/acknowledge-all", h.AcknowledgeAllEvents)
+	g.POST("/events/delete", h.DeleteEvents)
 }
 
 func (h *AlertsHandler) ListChannels(c *gin.Context) {
@@ -125,10 +131,64 @@ func (h *AlertsHandler) ListEvents(c *gin.Context) {
 			limit = n
 		}
 	}
-	out, err := h.Service.ListEvents(c.Request.Context(), limit)
+	// ?open=true → nur offene (nicht quittierte) Events. Nutzt die
+	// Dashboard-Karte, damit Quittieren die Meldung verschwinden lässt.
+	openOnly := c.Query("open") == "true"
+	out, err := h.Service.ListEvents(c.Request.Context(), limit, openOnly)
 	if err != nil {
 		response.Internal(c, err)
 		return
 	}
 	response.OK(c, gin.H{"events": out})
 }
+
+// eventIDsRequest ist der Body für Bulk-Quittieren/-Löschen.
+type eventIDsRequest struct {
+	IDs []int64 `json:"ids"`
+}
+
+// AcknowledgeEvents quittiert die übergebenen Event-IDs.
+func (h *AlertsHandler) AcknowledgeEvents(c *gin.Context) {
+	var req eventIDsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	n, err := h.Service.Acknowledge(c.Request.Context(), req.IDs)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "alert.events.acknowledge",
+		strconv.Itoa(len(req.IDs)), gin.H{"ids": req.IDs, "acknowledged": n}, h.NodeID)
+	response.OK(c, gin.H{"acknowledged": n})
+}
+
+// AcknowledgeAllEvents quittiert alle offenen Events.
+func (h *AlertsHandler) AcknowledgeAllEvents(c *gin.Context) {
+	n, err := h.Service.AcknowledgeAll(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "alert.events.acknowledge_all",
+		"all", gin.H{"acknowledged": n}, h.NodeID)
+	response.OK(c, gin.H{"acknowledged": n})
+}
+
+// DeleteEvents löscht die übergebenen Event-IDs endgültig.
+func (h *AlertsHandler) DeleteEvents(c *gin.Context) {
+	var req eventIDsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	n, err := h.Service.DeleteEvents(c.Request.Context(), req.IDs)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "alert.events.delete",
+		strconv.Itoa(len(req.IDs)), gin.H{"ids": req.IDs, "deleted": n}, h.NodeID)
+	response.OK(c, gin.H{"deleted": n})
+}