Security Event Correlation: Normalised Events & Incident Aggregation Layer

[elanlaw1206]

Summary

This PR introduces the foundation for security event correlation by adding a normalised security event model and an initial incident aggregation layer.

The goal of this change is to prepare the backend for correlating related authentication and security events into higher-level incidents, supporting future security analysis and reporting features.

---

Key Changes

• Introduced a normalised SecurityEvent model to standardise security telemetry.
• Added SecurityEventType definitions to unify event classification across sources.
• Implemented an initial incident aggregation layer to group related security events.
• Prepared backend logic for future correlation enhancements (confidence scoring, timelines, severity).
• Changes are backend-only and focused on data modelling and aggregation logic.

---

Design Notes

• This PR focuses on correlation foundations rather than end-user reporting.
• No frontend dependency is introduced.
• No existing API behaviour is modified.
• Designed to be extended by later features (e.g. security insights export, dashboards).

---

Testing / Validation

• Logic validated through service-level execution and controlled test data.
• No breaking changes introduced.

---

Scope

This change is self-contained and safe to merge. It establishes the groundwork for subsequent security insights and reporting features.

Primary contributor: King Hei Law

[wenyupeng]

code review: pass.

[wenyupeng]

code review: pass.