chore: initial project skeleton

Acauã: Network Detection & Threat Hunting, heuristic analysis over a
rolling 7-day window using deterministic math (time series, graph
theory, information theory) instead of opaque ML models. Third
product in the Ciberfauna ecosystem, alongside Guará and Sabiá.

Follows the ecosystem's established conventions: OpenWolf project
memory, bilingual PT-BR/EN docs and UI, Gitea Actions CI/CD on the
same self-hosted runners, Conventional Commits, SemVer, logo and
productName handling, MIT OR Apache-2.0 licensing.

Architecture decision (made with the project owner after a dedicated
consultation, not the original blueprint's suggested stack): Rust
throughout, not Python/FastAPI/React. Most of the statistics (Bowley
skew, MADM, Shannon entropy, PCR, Z-score, novel-edge detection,
pivot chains) reduces to SQL over an embedded DuckDB/Parquet store;
only the spectral analysis and graph centrality need host-language
code, and both have workable Rust crates. Documented in full, including
six corrections to the original blueprint's math (Rayleigh/Schuster
instead of a degenerate Lomb-Scargle over bare timestamps, an explicit
sentinel for Bowley skew's Q3=Q1 case, Jensen-Shannon instead of
unbounded KL, a dedicated long-connection detector, JA4 vs. JA4+
licensing caution, deterministic per-alert evidence), in
docs/architecture.md.

Skeleton only: crates/acaua-core has the four detection pillars,
fusion, storage, zeek log parsing and the updater as typed stubs that
compile and return a clear "skeleton" status rather than real
detection logic — that is separate, future work. crates/acaua-cli has
serve/analyze/doctor/update. apps/gui is a minimal Tauri shell. Also
already includes the one-click desktop self-update mechanism shared
with Guará and Sabiá (AppImage/.deb/Windows installer), even with no
release published yet, for consistency across the ecosystem.

No Gitea repository exists for this project yet; this is a local-only
commit.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

docs/interface.md

@@ -0,0 +1,67 @@
+# Interface
+
+**English** · [Português](pt-BR/interface.md)
+
+The interface is a vanilla HTML/CSS/JS app embedded in the `acaua` binary and
+loaded by the Tauri shell. There is no frontend build step and no React/Next.js
+runtime. This page describes the `0.1.0` shell; it is not a screenshot tour,
+because the detection views have nothing real to show yet.
+
+## Layout
+
+- **Sidebar:** brand, navigation, connection state, version and update check.
+- **Overview:** scope notice, authorized-use notice and the four pillar cards.
+- **Analysis:** dataset path field, analyze button, refresh and raw JSON output.
+- **Alerts:** empty state explaining that the detection engine will arrive in a
+  later spec.
+- **Settings:** language and theme, stored locally.
+
+## Language
+
+The source text is Portuguese. `i18n.js` applies English strings from
+`i18n-en.js` at runtime and persists the choice in `localStorage`. `Auto`
+follows the browser/system language. The check `node scripts/check-ui-i18n.mjs`
+fails when a visible Portuguese string has no English pair.
+
+## Theme
+
+`Auto`, light and dark are supported. `Auto` follows `prefers-color-scheme`. The
+choice is stored locally; no preference leaves the machine.
+
+## Connection state
+
+The footer polls `/api/health` and shows one of:
+
+- **Connecting:** the first request has not finished.
+- **Local service online:** `/api/health` answered.
+- **Service unavailable:** the request failed; the shell remains usable for settings.
+
+The Tauri shell can point at a local daemon or a remote `serve` in a future
+version. In `0.1.0` it uses the local API.
+
+## Analysis view
+
+`Analyze` posts the path to `/api/analyze` and prints the JSON response. The
+skeleton validates the path and returns a stub report. It does not parse Zeek
+records and does not render scores. Failures are shown as text, never as a
+silent empty state.
+
+## Alerts view
+
+The list is intentionally empty. A future alert row will show the pillar, score,
+timestamp and a link to the evidence record. The evidence must include inputs,
+intermediate values, sentinels, weights and the code version; a score alone is
+not enough.
+
+## Accessibility
+
+- Navigation uses real buttons and an `aria-label`.
+- The settings dialog uses `<dialog>` with a labelled title.
+- Status changes use text, not color alone.
+
+## Limitations
+
+- No real screenshots: the views are shells.
+- No alert detail, no charts and no dataset browser yet.
+- No authentication: the UI assumes a loopback daemon.
+- The desktop app does not self-update; it only reports an available version.