Watchman: security operations and threat triage dashboard

analysts were drowning in alerts. the product runs detect, correlate, contain: live telemetry vs baselines, threat category breakdown, related alerts grouped into incident timelines and automated playbooks for host isolation and credential resets, in a dense dark mode soc ui.