advisor latency path: missing endpoint IPs are grouped together

[echemythia]

Deep advise review found a grouping edge case in the latency-path advisory.

Current behavior:

• check_latency_path() groups connections by endpoint.endpoint_ip.
• When endpoint_ip is missing, it uses the literal key "unknown".

Connections can miss endpoint IP attribution, for example when attached mid-flight, while still carrying region/SNI/min RTT. Multiple unrelated endpoints with missing IP are then merged into one group before cross-region/high-RTT/unjudged decisions.

Relevant path:

• crates/s3tap-advisor/src/checks/service.rs

Impact: false or confusing advisor-latency-* findings when endpoint IP attribution is missing.

Suggested direction:

• Use a safer fallback grouping key, possibly region plus SNI where available.
• Or emit an unjudged/no-IP finding per safer scope instead of merging all unknown endpoints.
• Add tests with two missing-IP endpoint groups that should not share one median or label.