FEAT: EVE Reader - rotation-safe file handling with inotify

[itcmsgr]

Split from #41

Issue #41 (EVE Reader - alert-only file ingestion) has been partially completed.

Completed (keeping #41 open for tracking)

• ✅ Alert-only parsing implemented (pkg/suricata/reader.go lines 133-138)
• ✅ Skip non-alert events (flow, stats, etc.)
• ✅ Dual-output architecture configured

This Issue: Remaining Work

• Add fsnotify to go.mod dependencies
• Detect file rotation via inode change or size reset
• Reopen file handle gracefully on rotation
• Preserve event processing state across rotations
• No event loss during logrotate operations

Technical Context

Current implementation uses polling (100ms ticker) without rotation detection:

// pkg/suricata/reader.go - current polling model
ticker := time.NewTicker(100 * time.Millisecond)

Risk: If logrotate rotates eve-alerts.json while daemon is running, events can be lost.

Solution: Implement fsnotify-based file watcher with rotation detection.

Acceptance Criteria

• File rotation handled without losing events
• Works with standard logrotate configurations
• No increase in CPU usage vs current polling
• Unit tests for rotation scenarios