feat: implement Pillars 2-4 and fix a production false-positive in Pillar 1

Pillar 1 v1.1 (shipped earlier) flagged benign browsing bursts as
beaconing: on short captures, grid periods longer than the observed
span never complete a cycle, so significance saturates to 1 and the
score sticks at exactly 0.5. v1.2 caps the grid at a third of the
observed span, requires a minimum number of completed cycles, and
excludes protocols that are periodic by nature (NTP, DNS, mDNS,
ICMP). Validated against 300 seeds per scenario: false positives on
bursty traffic drop from the 290-300/300 that v1.1 produced to 0/300,
with every beacon-detection scenario scoring unchanged.

Add Pillar 2 (persistent/long-lived sessions, with Zeek's fragmented
TCP sessions rejoined after a 5-minute gap), Pillar 3 (DNS tunneling
via Shannon-entropy information volume per subdomain per hour; the
Jensen-Shannon divergence was measured and does not separate tunnels
from benign CDN subdomains, so it stays in the evidence at zero
weight instead of in the score), and Pillar 4 (deterministic
noisy-OR fusion across the three pillars).

The fusion formula was validated against 8 labeled real-traffic
vectors (IoT-23, CTU-Normal) with tolerance <= 1e-4. A known
limitation is kept, not hidden: a benign Philips HUE bulb's strict
periodic polling and a 21.9h session score it above three real C2
hosts. No weight or threshold was tuned to mask this; it is
documented in the architecture docs instead.

Also fixes real bugs found along the way: ingest_dir's partition
count summed file names instead of distinct dates, DuckDB errors
were counted as bad rows, /api/alerts always returned an empty list
regardless of the last analysis, and the dashboard still claimed
every pillar was unimplemented.

Restores four design corrections that were missing from
docs/architecture.md (KL to Jensen-Shannon, the persistent-session
detector, the JA4 licensing boundary, and deterministic reduction
order), and catalogs the public datasets used for validation
(IoT-23, CTU-Normal, Mendeley DTQBC) with their licenses and SHA-256
checksums under research/validation/.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD

crates/acaua-core/tests/smoke.rs

@@ -4,6 +4,7 @@ use acaua_core::{doctor, fusion, pillar1, pillar2, pillar3, pillar4, storage, ze
 fn pillar1_returns_a_skeleton_score() {
     let input = pillar1::BeaconingInput {
         timestamps: vec![1.0, 2.0, 3.0],
+        proto: "tcp".to_string(),
     };
     let score = pillar1::score(&input).unwrap();
     assert_eq!(score.observations, 3);
@@ -13,33 +14,49 @@ fn pillar1_returns_a_skeleton_score() {
 #[test]
 fn pillar2_counts_long_connections_without_panicking() {
     let input = pillar2::SessionInput {
-        durations_secs: vec![1.0, 400.0],
-        bytes: vec![10, 20],
+        sessions: vec![
+            pillar2::SessionCandidate {
+                start_ts: 1000.0,
+                end_ts: 1001.0,
+                duration: 1.0,
+                parts: 1,
+                orig_bytes: 10,
+                resp_bytes: 20,
+            },
+            pillar2::SessionCandidate {
+                start_ts: 2000.0,
+                end_ts: 2400.0,
+                duration: 400.0,
+                parts: 1,
+                orig_bytes: 100,
+                resp_bytes: 200,
+            },
+        ],
+        failed_attempts: 0,
     };
     let score = pillar2::score(&input).unwrap();
-    assert_eq!(score.long_connections, 1);
-    assert_eq!(score.status, "skeleton");
+    assert_eq!(score.longest_session_seconds, 400.0);
+    assert_eq!(score.status, "ok");
 }
 
 #[test]
-fn pillar3_handles_an_empty_protocol_list() {
-    let score = pillar3::score(&pillar3::ProtocolInput::default()).unwrap();
-    assert_eq!(score.distinct_protocols, 0);
-    assert_eq!(score.status, "skeleton");
+fn pillar3_handles_empty_dns_input() {
+    let scores = pillar3::score(&pillar3::ProtocolInput::default()).unwrap();
+    assert!(scores.is_empty());
 }
 
 #[test]
 fn pillar4_fuses_three_inputs() {
-    let score = pillar4::score(&pillar4::FusionInput::default()).unwrap();
-    assert_eq!(score.inputs, 3);
-    assert_eq!(score.status, "skeleton");
+    let score = pillar4::score("10.0.0.1", &pillar4::FusionInput::default()).unwrap();
+    assert_eq!(score.terms.len(), 3);
+    assert_eq!(score.formula_version, "1.0");
+    assert_eq!(score.score, 0.0);
 }
 
 #[test]
 fn fusion_returns_no_alerts_yet() {
-    let report = fusion::fuse(&[0.1, 0.2]).unwrap();
-    assert!(report.alerts.is_empty());
-    assert_eq!(report.status, "skeleton");
+    let hosts = fusion::fuse(&[]).unwrap();
+    assert!(hosts.is_empty());
 }
 
 #[test]
@@ -67,5 +84,5 @@ fn zeek_classifies_known_logs() {
 fn doctor_reports_checks() {
     let report = doctor::run();
     assert!(!report.checks.is_empty());
-    assert_eq!(report.status, "skeleton");
+    assert!(report.status == "ok" || report.status == "degraded");
 }