feat(baseline): P3 statistical baseline analysis engine

- Add zerotrace_baseline.go with three detection modes:
  1. EWMA anomaly: per-host metric deviation (unique_domains, dst_ips,
     bytes_up, dns_queries, http_requests) with configurable alpha/threshold
  2. First-seen: new domains not observed in 7-day lookback window,
     severity escalated by DGA score
  3. Beacon detection: periodic DNS connection intervals with low jitter
     (coefficient of variation < 0.15) indicating C2 communication
- Auto-creates siteguard.baseline_alerts and siteguard.ewma_baselines tables
- EWMA baselines use ReplacingMergeTree for in-place updates
- Endpoints: POST /probe/baseline/run, GET /probe/baseline/status
- Also detects: high DGA score hosts (>=0.7) and suspicious path hit hosts
- Register baseline routes in zerotrace.go
- Verified: 143 alerts generated on first run, 26 EWMA baselines initialized

Author: DeepShield Dev

controller/http/router/agent/zerotrace.go

@@ -69,6 +69,10 @@ func (a *ZeroTrace) RegisterTo(e *gin.Engine) {
 	// Pull query proxy — server forwards queries to agent's local data
 	g.POST("/probe/query", a.handleAgentQuery)
 
+	// Baseline analysis engine — statistical anomaly detection
+	g.POST("/probe/baseline/run", a.handleBaselineRun)
+	g.GET("/probe/baseline/status", a.handleBaselineStatus)
+
 	// Usage metering — internal endpoint for billing (no API key required)
 	e.GET("/api/v1/usage/metering", a.handleUsageMetering)
 }