feat: problem rules v1 brute-force, privilege spike, host silence (d1-3)

- Threshold rules on ingest; heartbeat auto-resolves host silence

- Config thresholds in sac-api.env; unit tests

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/config.py

@@ -56,6 +56,14 @@ class Settings(BaseSettings):
     # Окно корреляции Problems: host + type + rule в одном open Problem
     sac_problem_correlation_window_minutes: int = 60
 
+    # rule:brute_force_burst — ssh.login.failed / rdp.login.failed
+    sac_brute_force_window_minutes: int = 15
+    sac_brute_force_threshold: int = 30
+
+    # rule:privilege_spike — privilege.sudo.command
+    sac_privilege_spike_window_minutes: int = 10
+    sac_privilege_spike_threshold: int = 10
+
 
 @lru_cache
 def get_settings() -> Settings: