feat(proxy): integrate DDoS, scanner, and rate limiter into request pipeline

Wire up all three detection layers in request_filter with pipeline
logging at each stage for unfiltered training data. Add DDoS, scanner,
and rate_limit config sections. Bot allowlist check before scanner
model on the hot path. CLI subcommands for train/replay.

Signed-off-by: Sienna Meridian Satterwhite <sienna@sunbeam.pt>

tests/e2e.rs

@@ -101,7 +101,7 @@ fn start_proxy_once(backend_port: u16) {
             paths: vec![],
         }];
         let acme_routes: AcmeRoutes = Arc::new(RwLock::new(HashMap::new()));
-        let proxy = SunbeamProxy { routes, acme_routes };
+        let proxy = SunbeamProxy { routes, acme_routes, ddos_detector: None, scanner_detector: None, bot_allowlist: None, rate_limiter: None };
 
         let opt = Opt {
             upgrade: false,