SOC/NOC hardening: mode presets, vector schema, QoS planner, lockdown template, CI tests

[01rabbit]

Summary

• read mode presets and thresholds from azazel.yaml, add moving-average score evaluation, and persist action decisions per mode
• normalize Suricata/OpenCanary logs to a unified Vector schema with jsonschema-backed unit tests
• compute QoS HTB class plans from profile uplinks, add lockdown nftables template, and ship an FQDN allowlist resolver script
• extend docs and CI to cover the new presets, schema validation, pytest, shellcheck, and allowlist generation

Testing

• pytest tests/unit -q
• python scripts/resolve_allowlist.py --dry-run

---

https://chatgpt.com/codex/tasks/task_e_68d26a3cb0048323860c286e8d68c18a