Add deauth/disassoc detection — firmware capture, coordinator ingestion, Alerts tab with burst detection

coordinator/templates/dashboard.html

@@ -28,6 +28,7 @@
     <button class="tab-btn"        id="tab-crossnode"  onclick="showCrossNode()">Cross-node</button>
     <button class="tab-btn"        id="tab-clients"    onclick="showClients()">Clients</button>
     <button class="tab-btn"        id="tab-presence"   onclick="showPresence()">Presence</button>
+    <button class="tab-btn"        id="tab-alerts"     onclick="showAlerts()">Alerts</button>
   </div>
 
   <!-- Sidebar -->
@@ -304,6 +305,47 @@
 
     </div><!-- /#view-presence -->
 
+    <!-- Alerts view -->
+    <div id="view-alerts" class="view">
+
+      <!-- Summary strip -->
+      <div id="alerts-summary" class="alerts-summary"></div>
+
+      <!-- Detected bursts -->
+      <div class="section-header">
+        <span class="section-title">Detected Bursts</span>
+        <span class="section-count" id="bursts-count"></span>
+        <span class="presence-sub">≥10 deauth/disassoc frames for same BSSID in last 5 min</span>
+      </div>
+      <div class="tbl-wrap">
+        <table>
+          <thead><tr>
+            <th>BSSID</th><th>SSID</th><th>Type</th><th>Frames</th>
+            <th>Unique Srcs</th><th>Nodes</th><th>First</th><th>Last</th>
+          </tr></thead>
+          <tbody id="bursts-tbody"></tbody>
+        </table>
+        <div class="empty" id="bursts-empty" style="display:none">No bursts detected in last 5 minutes.</div>
+      </div>
+
+      <!-- Raw deauth feed -->
+      <div class="section-header" style="margin-top:8px">
+        <span class="section-title">Recent Deauth / Disassoc Events</span>
+        <span class="section-count" id="deauth-count"></span>
+      </div>
+      <div class="tbl-wrap">
+        <table>
+          <thead><tr>
+            <th>Time</th><th>Node</th><th>Type</th><th>Src</th>
+            <th>Dst</th><th>BSSID</th><th>Reason</th><th>RSSI</th>
+          </tr></thead>
+          <tbody id="deauth-tbody"></tbody>
+        </table>
+        <div class="empty" id="deauth-empty" style="display:none">No deauth events yet. Nodes need to be reflashed with deauth detection enabled.</div>
+      </div>
+
+    </div><!-- /#view-alerts -->
+
   </div><!-- /#main -->
 </div><!-- /#app -->