feat: add daemon mode for long-running real-time detection

[mostafa]

Summary

Adds a new daemon subcommand that runs rsigma as a persistent, long-running detection service — designed to sit behind a log collector (e.g. hel run | rsigma daemon ...) and process events continuously.

• Continuous NDJSON processing — reads events from stdin, evaluates against Sigma detection and correlation rules, writes matches to stdout
• HTTP management API — health (/healthz, /readyz), Prometheus metrics (/metrics), status and rule introspection (/api/v1/status, /api/v1/rules), and manual reload trigger (POST /api/v1/reload)
• Hot-reload — file watcher on the rules directory (debounced 500ms), SIGHUP signal handler, and API endpoint all trigger rule reloads without restart
• Prometheus metrics — events processed, detection/correlation matches, parse errors, rules loaded, state entries, reload counts, per-event latency histogram, uptime
• Structured logging — JSON to stderr via tracing, configurable with RUST_LOG
• Feature-gated — daemon feature (enabled by default) pulls in tokio, axum, prometheus, and notify as optional dependencies
• CI updated — all workflows now use --all-features to ensure feature-gated code is always checked, linted, tested, and shipped

How it differs from eval

	eval	daemon
Lifecycle	Exits after processing all input	Stays alive, waits for more input
HTTP API	None	Health, metrics, management endpoints
Hot-reload	N/A (one-shot)	File watcher + SIGHUP + API
Observability	Stderr summary	Prometheus metrics + structured JSON logs
Use case	Batch analysis, scripting, CI	Production pipeline, real-time detection

New files

File	Purpose
daemon/mod.rs	Module structure, re-exports run_daemon
daemon/server.rs	Main orchestration: HTTP server, stdin reader, reload logic, API handlers
daemon/state.rs	DaemonEngine wrapper over stateless Engine or stateful CorrelationEngine
daemon/engine.rs	Per-line event processing with filter application
daemon/metrics.rs	Prometheus metric initialization and registration
daemon/health.rs	Atomic readiness state
daemon/reload.rs	File system watcher and SIGHUP handler

Test plan

• cargo check --workspace --all-features passes
• cargo clippy --workspace --all-targets --all-features -- -D warnings clean
• cargo test --workspace --all-features — 60 tests pass
• Smoke test: pipe a single event through rsigma daemon, confirm match output
• Verify hot-reload: modify a rule file while daemon is running
• Verify /healthz, /readyz, /metrics, /api/v1/status, /api/v1/rules responses
• Verify POST /api/v1/reload triggers reload
• Build without daemon feature: cargo build -p rsigma --no-default-features