Extend Suricata to Degens (VLAN 10) #89

Suricata has run on Skids (VLAN 20) alert-only since 2026-08-21. Alerts reach
Loki with classification and priority parsed into labels, verified against
real traffic.

Degens (VLAN 10, guest) is next — one interface at a time, because with two
interfaces feeding one pipeline there is no way to tell which is producing the
noise.

Precondition: Skids has to be quiet and understood for a few days first. The
first tuning decision there was made from measurement rather than prediction —
sid 2200121 "Ethertype unknown" was 100% of alerts and turned out to be LLDP
from neo, suppressed by signature rather than by disabling the whole
decoder-events category. Guest traffic will have its own equivalent.

→ runbook

Tracked in docs/roadmap.md; filed as an issue so it has a place to be discussed and closed.