Add sustained-download detection; drop dead stick-table peer listener

[awlx]

Summary

Adds detection for clients that pull large volumes over a long window — the "slow, patient scraper" shape that rate-based detection misses because no individual interval looks abusive. Selection is on duration and breadth, not rate.

Two independent signals, AND-ed:

• Volume — a new eBPF TC-egress per-client byte counter. This is the only correct source: HAProxy cannot report transferred bytes without stick tables (bytes_out is per-stream and zeroed by stream_new, and keep-alive allocates a new stream per request, so it never accumulates). res.body_size only gives advertised Content-Length, useless for streamed responses — deliberately not used as a fallback rather than introducing a second, inconsistent byte source.
• Breadth/shape — resource and section fan-out, observed via the existing SPOE agent.

Also removes the HAProxy peer (stick-table) listener. It was dead code: it blocked on any stick-table update with no volume logic and was never wired to anything.

Enforcement kill switch

POST /api/enforcement/stop halts every enforcing command analyzer-wide while detection keeps running. Deliberately placed at the command-issuing boundary (Broadcast + sendCommand) rather than inside one detector, so it covers all of them. It is checked before the dedup reservation — otherwise a suppressed block would mark the IP "recently blocked" and stay suppressed for the dedup TTL after enforcement resumed. One-way by design: resuming needs a config change and a restart.

Safety

Everything ships off by default, and enabling detection does not enable blocking (-sustained-enabled vs -sustained-enforce). Design choices that bound false-positive cost:

• Reputation multiplies request/byte floors only, never resource/section floors — breadth isn't an entitlement.
• Release from hold is judged on requests/resources/sections, never bytes, since blocking destroys the byte evidence.
• The hard hold ceiling is mandatory; good-reputation clients leave at the floor.
• Allowlisted IPs are skipped entirely. The reputation hook is wired to verified bots, not the reputation engine — reputation entries are only created by penalties, so score 0 means "never seen", not "well behaved".
• Raw paths and hostnames are never retained, only FNV-64a hashes with a separator so ("ab","c") != ("a","bc").

⚠️ Breaking change

-haproxy-port is removed. Go's flag parser rejects unknown flags, so a collector still passing it exits 2, and Restart=on-failure turns that into a crash loop. A local systemd drop-in overriding ExecStart= shadows the shipped unit and survives the upgrade — this is a real failure that happened during testing. collector-postinstall.sh now inspects the resolved config and names the offending files; it warns rather than edits, since the package has no business rewriting operator-authored drop-ins.

Check before upgrading:

systemctl cat packetyeeter-collector | grep -n haproxy-port   # expect no output

Housekeeping

Adds root-anchored ignore rules so stray go build -o analyzer output at the repo root can't be committed, and switches the docs to placeholder hostnames.

Validation

• gofmt, go vet, git diff --check, make portable-test (13/13 packages) all clean.
• eBPF verified through a real kernel verifier, not just compiled.
• Validated on Linux 6.8 against live traffic: eBPF loaded and attached, egress_bytes maps populated per client, signals reached the analyzer attributed to the correct IP, the byte floor gated as designed (796 signals at a 4 KiB test floor vs 1 at the production 1 MiB floor), /api/sustained tracked hundreds of clients with blockers/margins populated, and the kill switch flipped both the endpoint and packetyeeter_enforcement_stopped.
• Confirmed an older analyzer tolerates the new SIGNAL_EGRESS_VOLUME without erroring, so a collector-first rollout is safe.

Live testing also caught a bug not visible in unit tests: the collector serves metrics from an allowlist registry, so the egress counters were incremented but never scrapeable. They're now registered on the collector's registry, and the docs say which process to scrape (the analyzer registers the same names and reports a constant 0).

A code review during development caught one high-severity bug, fixed here with a regression test verified to fail against the old code: the IPv6 map iterator reuses one [16]byte key per poll, and signals are marshaled asynchronously off the queue, so storing the caller's net.IP directly meant a queued signal could report the wrong client.