Docs: add SOC analyst job description (duty instruction) and resize druzhinajpg.jpg

Docs: ARCHITECTURE.md — update GoHoneypot section (service lures, DELAY_PATHS, /api/aggregate, UI) and Cowrie rules list

Honeypot: go mod tidy — drop unused tlsx/gopacket deps

Honeypot: new lures (WordPress REST/Grafana/Jenkins/phpMyAdmin/OWA/Console) + /api/aggregate dashboard (top IPs, MITRE, passwords, UA, heatmap) + UI section

Honeypot: artificial response delays (DELAY_PATHS) — 5-10s on admin/login/config paths to distinguish scanners from humans, CLIENT_ABORT detection

Cowrie: SSH honeypot integrated — container on leo3:8022, Wazuh rules 100200-100204 (login/bruteforce/command/file_download/connect), docs in ARCHITECTURE.md

Cowrie: add SSH honeypot container (port 8022 external, cowrie-data volume)

Backup: include honeypot.db (+WAL) in archive, exclude CRS tests and nginx downloads (9.6M -> 440K)

Backup: add backup_request.py cron handler for manual backup button (runs backup.sh + push to leo2)

Fix: backupState ReferenceError — move dynamic styles inline, keep styles static

Dashboard: add manual backup button (POST /api/backup/run + GET /api/backup/status) with host-side backup_request.py cron handler -> backup.sh + rsync to leo2

Docs: add ARCHITECTURE.md — full service inventory of Druzhina SOC platform (portal services, external systems, data, alerts, automation, backups)

AlertsPage: default query from agent.id:001 to rule.id:* (agent IDs changed after Wazuh migration)

Revert "Migrate Wazuh links to leo2 (192.168.21.107): replace hardcoded 10.10.10.2/localhost:9443 with config-driven OPENSEARCH_URL, WAZUH_URL, dashboard :5601"

Migrate Wazuh links to leo2 (192.168.21.107): replace hardcoded 10.10.10.2/localhost:9443 with config-driven OPENSEARCH_URL, WAZUH_URL, dashboard :5601

Honeypot: strip port from remote_addr on insert (fix IP grouping in profiles); CI/CD: build honeypot in deploy pipeline

Honeypot: attacker IP profiles API (/api/profiles) with categories (recon/config_access/auth_brute/exploit_hunting/api_discovery/cms_scan) + profiles table in UI

Honeypot: fake login success on POST /admin/* to harvest password wordlists; README: startup order after reboot

Honeypot: smart replies (robots/sitemap/config/admin/session/mcp) + new MITRE classifications for observed paths

Fix startup race: depends_on service_healthy (auth before gateway before waf)

README: remove credentials, keep only where they are set

Dashboard: add UptimeRobot external monitoring link to security projects