feat: CorrelationID propagation across nginx → CrowdSec → Cloudflare

[jmrGrav]

Context

Currently events from different sources (nginx access log, CrowdSec decision, CF WAF event) for the same IP+time window exist independently. There is no shared identifier linking them into a causal chain.

Goal

Propagate a CorrelationID (derived from IP + time bucket) that can be used to group related events across sources without joining on timestamps.

Non-goal

Full causal engine (v1.8.0+). This issue is about establishing the identifier scheme only.

Acceptance criteria

• CorrelationID generation function: correlationID(ip string, bucket time.Time) string
• Applied to CrowdSec events on ingest
• Applied to nginx access events on ingest
• Applied to CF WAF events on ingest
• Stored in timeline event table
• Queryable via timeline filter corr:<id>