feat: add 4 anomaly detection agents for contract upgrades, notifications, exports, websockets (#1208 #1209 #1210 #1211)

[luciachizaram]

Summary

This PR adds 4 anomaly detection agents (#1208, #1209, #1210, #1211):

Fixes #1208 — Contract upgrade detection agent

• contractUpgradeDetectionAgent.ts detects unauthorized upgrade attempts
• Detects: insufficient approvals on execute, unknown/non-whitelisted signers, rapid proposals per contract
• Configurable thresholds: minApprovalsForExecute, rapidProposalWindowMs, rapidProposalCountThreshold, allowedSigners
• Tests: true-positive (insufficient approvals, unknown signer, rapid proposals) and true-negative (sufficient approvals, spaced proposals)

Fixes #1209 — Notification flooding detection agent

• notificationFloodingDetectionAgent.ts detects abnormal notification volume
• Detects: user flood, template flood, channel abuse
• Configurable thresholds: userFloodCountThreshold, templateFloodCountThreshold, channelAbuseCountThreshold with respective windows
• Tests: true-positive (user flood, template flood) and true-negative (normal volume)

Fixes #1210 — Bulk data export exfiltration detection agent

• bulkExportDetectionAgent.ts detects unusually large/frequent data exports
• Detects: bulk volume (absolute), oversized exports, frequent exports per user
• Configurable thresholds: bulkVolumeThreshold, frequentExportCountThreshold, oversizedThreshold
• Tests: true-positive (bulk volume, frequent exports, oversized) and true-negative (normal export)

Fixes #1211 — Websocket connection abuse detection agent

• socketAbuseDetectionAgent.ts detects abnormal connection/reconnection patterns
• Detects: rapid reconnects per client, connection storms (global), excessive concurrent connections
• Configurable thresholds: rapidReconnectCountThreshold, connectionStormCountThreshold, maxConcurrentPerClient
• Tests: true-positive (rapid reconnect, concurrent, storm) and true-negative (normal connections)

All agents follow the existing anomalousFundMovementAlertService pattern: decoupled from service plumbing, unit-testable, configurable thresholds via constructor options, and emit structured anomaly events via onAnomaly handler.

[drips-wave]

@luciachizaram Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits