Add Incident / Correlation Engine

[XploitGost]

Summary

• add bounded, redacted, explainable incident correlation over flow, alert, attribution, and expert signals
• add protected read-only incident APIs, Live Ring and WebSocket batching, Ops metrics, and responsive Incident UI
• document retention, false-positive handling, unsupported Agent health correlation, and unchanged security boundaries

Validation

• Backend: 339 tests passed
• Frontend: 52 tests passed
• Frontend build: passed
• pip check: passed
• npm production audit: 0 vulnerabilities
• Benchmark smoke: 2000/2000 processed, 0 dropped, 0 failed (bounded live-ring evictions made final Ops health degraded as expected)
• Electron smoke: passed

Scope

Read-only analysis only. No AI, response actions, command/control, remote shell, TLS decryption, credential collection, IPS/auto-blocking changes, browser data inspection, or Agent raw forwarding. Incident persistence is intentionally deferred.