feat: add server-side Sigma conversion workbench

[egrexsec]

Summary

• add an optional FastAPI service for server-side pySigma conversion
• register only pinned Splunk, Elastic EQL, Elastic ES|QL, and Microsoft Kusto backends
• enforce safe parsing, a 256 KiB source limit, bounded response timeout, structured errors, and explicit CORS origins
• receive isolated worker results concurrently so complete near-limit responses cannot deadlock behind the multiprocessing pipe buffer
• return canonical source hashes plus converter package/version provenance
• add workbench conversion controls with loading, error, provenance, and stale-output states
• reject in-flight conversion responses when the authored Sigma source or request generation changes
• preserve static GitHub Pages compatibility by using an operator-configured external API origin
• await Next 16 dynamic-route params before resolving content lanes

Validation

• 16 Python contract/API/backend tests passed
• 16 Node workbench/content/dynamic-route tests passed
• Next.js 16.2.12 production static build passed
• Bandit passed with no reported findings
• npm audit --omit=dev reported 0 vulnerabilities
• live local smoke: /healthz, /v1/backends, and Splunk /v1/convert returned HTTP 200
• git diff --check

Security and deployment boundaries

• binds to localhost in documented examples
• authentication, TLS, and rate limiting must be added at a reverse proxy before broader exposure
• no query deployment or live SIEM validation occurs
• authored Sigma remains canonical; generated outputs are derived and marked stale after source edits

Stack

This is intentionally based on the shared-contract branch and should be reviewed/merged after #55.