feat: proactive host_silence scan for stale agent.heartbeat (0.8.3)

Background scan every 5 min opens rule:host_silence and notifies without
waiting for the next ingest event. CLI job + optional systemd timer.

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/env.native.example

@@ -63,6 +63,10 @@ SAC_DAILY_REPORT_REQUIRE_ACTIVITY=true
 # Статус хоста по agent.heartbeat
 SAC_HEARTBEAT_STALE_MINUTES=780
 
+# Проактивный алерт host_silence (без ожидания нового события с хоста)
+SAC_HOST_SILENCE_SCAN_ENABLED=true
+SAC_HOST_SILENCE_SCAN_INTERVAL_MINUTES=5
+
 # Корреляция Problems: host + type + rule в одном open Problem (минуты)
 SAC_PROBLEM_CORRELATION_WINDOW_MINUTES=60
 

deploy/systemd/sac-host-silence-scan.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Security Alert Center host silence scan (stale heartbeat)
+After=network-online.target postgresql.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=sac
+Group=sac
+WorkingDirectory=/opt/security-alert-center/backend
+EnvironmentFile=/opt/security-alert-center/config/sac-api.env
+ExecStart=/opt/security-alert-center/backend/.venv/bin/python -m app.jobs.host_silence_scan
+Nice=10
+
+[Install]
+WantedBy=multi-user.target

deploy/systemd/sac-host-silence-scan.timer

@@ -0,0 +1,11 @@
+[Unit]
+Description=Periodic SAC host silence scan (stale agent.heartbeat)
+
+[Timer]
+OnBootSec=3min
+OnUnitActiveSec=5min
+RandomizedDelaySec=30
+Persistent=true
+
+[Install]
+WantedBy=timers.target