初始提交：恶意 IP 特征+行为融合检测系统

- 特征检测（规则/签名）与行为检测（24h 统计）单进程运行
- 融合名单按首次发现时间倒序，展示位置/归属（GeoIP + ASN）
- 钉钉融合推送（加签、24h 节流、去重）
- 页面状态灯、CSV 导出、Docker 镜像构建文件

tests/demo.py

@@ -0,0 +1,50 @@
+"""Preview the CLI output without a real Graylog instance.
+
+Runs a handful of commands against the bundled fake Graylog 4.0 server so you
+can see the exact shape of the tables/JSON before pointing the tool at
+edu-master.
+
+    python3 tests/demo.py
+"""
+
+import io
+import os
+import sys
+from contextlib import redirect_stdout
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, os.path.dirname(HERE))
+sys.path.insert(0, HERE)
+
+from fake_graylog import JUDGE_MESSAGES, FakeGraylog  # noqa: E402
+from graylog_ops import cli  # noqa: E402
+
+COMMANDS = (
+    ["probe"],
+    ["streams"],
+    ["discover", "--range", "3600"],
+    ["top-ips", "--field", "client_ip", "--query", "status:401", "--size", "5"],
+    ["judge", "--range", "300", "--explain", "3"],
+)
+
+
+def main():
+    server = FakeGraylog(messages=JUDGE_MESSAGES).start()
+    base = ["--url", server.url, "--token", "testtoken"]
+    try:
+        for command in COMMANDS:
+            print("=" * 78)
+            print("$ graylog-ops " + " ".join(command))
+            print("-" * 78)
+            captured = io.StringIO()
+            with redirect_stdout(captured):
+                cli.main(base + command)
+            print(captured.getvalue().rstrip())
+            print()
+    finally:
+        server.stop()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())