feat: ensemble ML, alert deduplication, larger synthetic dataset

- Replace IsolationForest with voting ensemble (IF + LOF + OC-SVM),
  anomaly flagged when ≥ 2/3 models agree
- Normalise per-process cpu_percent by CPU count to prevent false
  positives from multi-threaded processes (e.g. Firefox 130% → 65%)
- Deduplicate alerts: same PID anomalous within 30s updates last_seen
  and count instead of inserting a new row; WS broadcast only on first
  occurrence
- Show Duration column in Alerts table (e.g. "2м 30с ×28")
- Increase synthetic training data from 2000 to 10000 rows
- Add DB migration for last_seen/count columns on existing databases

agent/model.py

@@ -153,7 +153,7 @@ class EnsembleDetector:
            5 % heavier services (higher RAM, some connections)
         """
         rng = np.random.default_rng(42)
-        n = 2000
+        n = 10_000
 
         cpu_idle  = rng.exponential(0.3, int(n * 0.75))
         cpu_light = rng.uniform(0.5, 15,  int(n * 0.20))