add network traffic monitoring and adversary detection
- CrowdSec: add syslog listener for pfSense firewall logs (NodePort 30514),
add postfix/dovecot log acquisition, install pf/postfix/dovecot/sshd collections
- Monitoring: add DNS anomaly CronJob (queries Technitium every 15m, DGA detection,
pushes metrics to Pushgateway)
- Grafana: add "Network Traffic & Adversary Detection" dashboard
(GoFlow2 flows, CrowdSec decisions, DNS anomaly metrics)
pfSense changes applied live: syslog forwarding to 10.0.20.202:30514,
Snort suppress rules for http_inspect false positives, IPS connectivity policy enabled
55246c8b5d