feat: Phase 1 — ARIA ATM threat monitoring service

- Spring Boot service on port 8095, database hiveiq_aria
- Flyway schema: threat_ioc, threat_event, precursor_sequence_alert, device_security_posture
- FBI FLASH-20260219-001 IOC seed data (executables, MD5s, directories, registry keys, services)
- ThreatEventClassifier — maps 20+ signal keys to severity + attack phase + IOC match
- ThreatEventIngestionService — persists events, publishes HIGH/CRITICAL to Kafka
- Kafka producer: topic hiveops.aria.threats (AriaThreatEvent payload)
- ThreatIocController — CRUD IOC management (MSP_ADMIN/BCOS_ADMIN)
- ThreatEventIngestionController — agent-facing ingest endpoint with service secret auth
- CI/CD: cd-develop.yml + cd-main.yml

Dockerfile

@@ -0,0 +1,16 @@
+FROM eclipse-temurin:21-jre-alpine
+
+WORKDIR /app
+
+RUN addgroup -g 1000 hiveiq && \
+    adduser -D -u 1000 -G hiveiq hiveiq
+
+COPY target/*.jar app.jar
+
+RUN chown -R hiveiq:hiveiq /app
+
+USER hiveiq
+
+EXPOSE 8095
+
+ENTRYPOINT ["java", "-jar", "app.jar"]