feat(Production): Complete production deployment infrastructure

- Add comprehensive health check system with multiple endpoints
- Add Prometheus metrics endpoint
- Add production logging configurations (5 strategies)
- Add complete deployment documentation suite:
  * QUICKSTART.md - 30-minute deployment guide
  * DEPLOYMENT_CHECKLIST.md - Printable verification checklist
  * DEPLOYMENT_WORKFLOW.md - Complete deployment lifecycle
  * PRODUCTION_DEPLOYMENT.md - Comprehensive technical reference
  * production-logging.md - Logging configuration guide
  * ANSIBLE_DEPLOYMENT.md - Infrastructure as Code automation
  * README.md - Navigation hub
  * DEPLOYMENT_SUMMARY.md - Executive summary
- Add deployment scripts and automation
- Add DEPLOYMENT_PLAN.md - Concrete plan for immediate deployment
- Update README with production-ready features

All production infrastructure is now complete and ready for deployment.

tests/Framework/Waf/MachineLearning/MachineLearningEngineTest.php

@@ -9,29 +9,34 @@ use App\Framework\Core\ValueObjects\Percentage;
 use App\Framework\Core\ValueObjects\Timestamp;
 use App\Framework\DateTime\Clock;
 use App\Framework\DateTime\DateTime;
+use App\Framework\Http\IpAddress;
+use App\Framework\MachineLearning\Core\AnomalyDetectorInterface;
+use App\Framework\MachineLearning\Core\FeatureExtractorMetadata;
+use App\Framework\MachineLearning\ValueObjects\AnomalyDetection;
+use App\Framework\MachineLearning\ValueObjects\AnomalyType;
+use App\Framework\MachineLearning\ValueObjects\Feature;
+use App\Framework\MachineLearning\ValueObjects\FeatureType;
 use App\Framework\Waf\Analysis\ValueObjects\RequestAnalysisData;
-use App\Framework\Waf\MachineLearning\AnomalyDetectorInterface;
-use App\Framework\Waf\MachineLearning\AnomalyType;
-use App\Framework\Waf\MachineLearning\BehaviorType;
-use App\Framework\Waf\MachineLearning\FeatureExtractorInterface;
 use App\Framework\Waf\MachineLearning\MachineLearningEngine;
 use App\Framework\Waf\MachineLearning\MachineLearningResult;
-use App\Framework\Waf\MachineLearning\ValueObjects\AnomalyDetection;
-use App\Framework\Waf\MachineLearning\ValueObjects\BehaviorFeature;
+use App\Framework\Waf\MachineLearning\WafFeatureExtractor;
 use Mockery;
 use Mockery\MockInterface;
 
 // Hilfsfunktion zum Erstellen eines Mock-Extraktors
-function createMockExtractorMLE(bool $enabled = true, ?BehaviorType $behaviorType = null, array $features = []): MockInterface
+function createMockExtractorMLE(bool $enabled = true, ?FeatureType $featureType = null, array $features = []): MockInterface
 {
-    $behaviorType = $behaviorType ?? BehaviorType::PATH_PATTERNS;
+    $featureType = $featureType ?? FeatureType::STRUCTURAL_PATTERN;
 
-    $extractor = Mockery::mock(FeatureExtractorInterface::class);
+    $extractor = Mockery::mock(WafFeatureExtractor::class, FeatureExtractorMetadata::class);
     $extractor->shouldReceive('isEnabled')->andReturn($enabled);
-    $extractor->shouldReceive('getBehaviorType')->andReturn($behaviorType);
+    $extractor->shouldReceive('getFeatureType')->andReturn($featureType);
     $extractor->shouldReceive('getPriority')->andReturn(10);
-    $extractor->shouldReceive('canExtract')->andReturn(true);
-    $extractor->shouldReceive('extractFeatures')->andReturn($features);
+    $extractor->shouldReceive('canExtract')->with(Mockery::type(RequestAnalysisData::class))->andReturn(true);
+    $extractor->shouldReceive('extractFeatures')->with(Mockery::type(RequestAnalysisData::class), Mockery::type('array'))->andReturn($features);
+    $extractor->shouldReceive('getExpectedProcessingTime')->andReturn(10);
+    $extractor->shouldReceive('supportsParallelExecution')->andReturn(true);
+    $extractor->shouldReceive('getDependencies')->andReturn([]);
 
     return $extractor;
 }
@@ -39,12 +44,12 @@ function createMockExtractorMLE(bool $enabled = true, ?BehaviorType $behaviorTyp
 // Hilfsfunktion zum Erstellen eines Mock-Detektors
 function createMockDetectorMLE(bool $enabled = true, array $supportedTypes = [], array $anomalies = []): MockInterface
 {
-    $supportedTypes = $supportedTypes ?: [BehaviorType::PATH_PATTERNS];
+    $supportedTypes = $supportedTypes ?: [FeatureType::STRUCTURAL_PATTERN];
 
     $detector = Mockery::mock(AnomalyDetectorInterface::class);
     $detector->shouldReceive('isEnabled')->andReturn($enabled);
     $detector->shouldReceive('getName')->andReturn('MockDetector');
-    $detector->shouldReceive('getSupportedBehaviorTypes')->andReturn($supportedTypes);
+    $detector->shouldReceive('getSupportedFeatureTypes')->andReturn($supportedTypes);
     $detector->shouldReceive('canAnalyze')->andReturn(true);
     $detector->shouldReceive('detectAnomalies')->andReturn($anomalies);
     $detector->shouldReceive('updateModel')->andReturn(null);
@@ -55,10 +60,19 @@ function createMockDetectorMLE(bool $enabled = true, array $supportedTypes = [],
 // Hilfsfunktion zum Erstellen einer Beispiel-RequestAnalysisData
 function createSampleRequestData(): RequestAnalysisData
 {
-    return RequestAnalysisData::minimal(
+    return new RequestAnalysisData(
         method: 'GET',
+        url: '/test',
         path: '/test',
-        headers: ['User-Agent' => 'TestAgent']
+        queryString: '',
+        headers: ['User-Agent' => 'TestAgent'],
+        queryParameters: [],
+        postParameters: [],
+        cookies: [],
+        body: '',
+        files: [],
+        clientIp: IpAddress::localhost(),
+        timestamp: Timestamp::now()
     );
 }
 
@@ -97,14 +111,14 @@ test('gibt leeres Ergebnis zurück wenn deaktiviert', function () {
 
 test('extrahiert Features aus Request-Daten', function () {
     // Arrange
-    $feature = new BehaviorFeature(
-        type: BehaviorType::PATH_PATTERNS,
+    $feature = new Feature(
+        type: FeatureType::STRUCTURAL_PATTERN,
         name: 'test_feature',
         value: 42.0,
         unit: 'count'
     );
 
-    $extractor = createMockExtractorMLE(true, BehaviorType::PATH_PATTERNS, [$feature]);
+    $extractor = createMockExtractorMLE(true, FeatureType::STRUCTURAL_PATTERN, [$feature]);
 
     $engine = new MachineLearningEngine(
         enabled: true,
@@ -119,16 +133,17 @@ test('extrahiert Features aus Request-Daten', function () {
     $result = $engine->analyzeRequest(createSampleRequestData());
 
     // Assert
+    expect($result->error)->toBeNull();
     expect($result->features)->toHaveCount(1);
-    expect($result->features[0])->toBeInstanceOf(BehaviorFeature::class);
+    expect($result->features[0])->toBeInstanceOf(Feature::class);
     expect($result->features[0]->name)->toBe('test_feature');
     expect($result->features[0]->value)->toBe(42.0);
 });
 
 test('erkennt Anomalien in Features', function () {
     // Arrange
-    $feature = new BehaviorFeature(
-        type: BehaviorType::PATH_PATTERNS,
+    $feature = new Feature(
+        type: FeatureType::STRUCTURAL_PATTERN,
         name: 'test_feature',
         value: 42.0,
         unit: 'count'
@@ -136,7 +151,7 @@ test('erkennt Anomalien in Features', function () {
 
     $anomaly = new AnomalyDetection(
         type: AnomalyType::STATISTICAL_ANOMALY,
-        behaviorType: BehaviorType::PATH_PATTERNS,
+        featureType: FeatureType::STRUCTURAL_PATTERN,
         confidence: Percentage::from(75.0),
         anomalyScore: 0.8,
         description: 'Test anomaly',
@@ -149,8 +164,8 @@ test('erkennt Anomalien in Features', function () {
         ]
     );
 
-    $extractor = createMockExtractorMLE(true, BehaviorType::PATH_PATTERNS, [$feature]);
-    $detector = createMockDetectorMLE(true, [BehaviorType::PATH_PATTERNS], [$anomaly]);
+    $extractor = createMockExtractorMLE(true, FeatureType::STRUCTURAL_PATTERN, [$feature]);
+    $detector = createMockDetectorMLE(true, [FeatureType::STRUCTURAL_PATTERN], [$anomaly]);
 
     $engine = new MachineLearningEngine(
         enabled: true,
@@ -173,8 +188,8 @@ test('erkennt Anomalien in Features', function () {
 
 test('filtert Anomalien basierend auf Konfidenz-Schwellenwert', function () {
     // Arrange
-    $feature = new BehaviorFeature(
-        type: BehaviorType::PATH_PATTERNS,
+    $feature = new Feature(
+        type: FeatureType::STRUCTURAL_PATTERN,
         name: 'test_feature',
         value: 42.0,
         unit: 'count'
@@ -182,7 +197,7 @@ test('filtert Anomalien basierend auf Konfidenz-Schwellenwert', function () {
 
     $highConfidenceAnomaly = new AnomalyDetection(
         type: AnomalyType::STATISTICAL_ANOMALY,
-        behaviorType: BehaviorType::PATH_PATTERNS,
+        featureType: FeatureType::STRUCTURAL_PATTERN,
         confidence: Percentage::from(80.0),
         anomalyScore: 0.8,
         description: 'High confidence anomaly',
@@ -192,7 +207,7 @@ test('filtert Anomalien basierend auf Konfidenz-Schwellenwert', function () {
 
     $lowConfidenceAnomaly = new AnomalyDetection(
         type: AnomalyType::STATISTICAL_ANOMALY,
-        behaviorType: BehaviorType::PATH_PATTERNS,
+        featureType: FeatureType::STRUCTURAL_PATTERN,
         confidence: Percentage::from(40.0),
         anomalyScore: 0.3,
         description: 'Low confidence anomaly',
@@ -200,8 +215,8 @@ test('filtert Anomalien basierend auf Konfidenz-Schwellenwert', function () {
         evidence: ['value' => 42.0, 'expected_value' => 30.0]
     );
 
-    $extractor = createMockExtractorMLE(true, BehaviorType::PATH_PATTERNS, [$feature]);
-    $detector = createMockDetectorMLE(true, [BehaviorType::PATH_PATTERNS], [$highConfidenceAnomaly, $lowConfidenceAnomaly]);
+    $extractor = createMockExtractorMLE(true, FeatureType::STRUCTURAL_PATTERN, [$feature]);
+    $detector = createMockDetectorMLE(true, [FeatureType::STRUCTURAL_PATTERN], [$highConfidenceAnomaly, $lowConfidenceAnomaly]);
 
     $engine = new MachineLearningEngine(
         enabled: true,
@@ -222,8 +237,8 @@ test('filtert Anomalien basierend auf Konfidenz-Schwellenwert', function () {
 
 test('berechnet Gesamt-Konfidenz korrekt', function () {
     // Arrange
-    $feature = new BehaviorFeature(
-        type: BehaviorType::PATH_PATTERNS,
+    $feature = new Feature(
+        type: FeatureType::STRUCTURAL_PATTERN,
         name: 'test_feature',
         value: 42.0,
         unit: 'count'
@@ -231,7 +246,7 @@ test('berechnet Gesamt-Konfidenz korrekt', function () {
 
     $anomaly1 = new AnomalyDetection(
         type: AnomalyType::STATISTICAL_ANOMALY,
-        behaviorType: BehaviorType::PATH_PATTERNS,
+        featureType: FeatureType::STRUCTURAL_PATTERN,
         confidence: Percentage::from(60.0),
         anomalyScore: 0.6,
         description: 'Anomaly 1',
@@ -241,7 +256,7 @@ test('berechnet Gesamt-Konfidenz korrekt', function () {
 
     $anomaly2 = new AnomalyDetection(
         type: AnomalyType::CLUSTERING_DEVIATION,
-        behaviorType: BehaviorType::PATH_PATTERNS,
+        featureType: FeatureType::STRUCTURAL_PATTERN,
         confidence: Percentage::from(80.0),
         anomalyScore: 0.4,
         description: 'Anomaly 2',
@@ -249,8 +264,8 @@ test('berechnet Gesamt-Konfidenz korrekt', function () {
         evidence: ['value' => 42.0, 'expected_value' => 10.0]
     );
 
-    $extractor = createMockExtractorMLE(true, BehaviorType::PATH_PATTERNS, [$feature]);
-    $detector = createMockDetectorMLE(true, [BehaviorType::PATH_PATTERNS], [$anomaly1, $anomaly2]);
+    $extractor = createMockExtractorMLE(true, FeatureType::STRUCTURAL_PATTERN, [$feature]);
+    $detector = createMockDetectorMLE(true, [FeatureType::STRUCTURAL_PATTERN], [$anomaly1, $anomaly2]);
 
     $engine = new MachineLearningEngine(
         enabled: true,
@@ -272,17 +287,17 @@ test('berechnet Gesamt-Konfidenz korrekt', function () {
 
 test('dedupliziert und sortiert Anomalien', function () {
     // Arrange
-    $feature = new BehaviorFeature(
-        type: BehaviorType::PATH_PATTERNS,
+    $feature = new Feature(
+        type: FeatureType::STRUCTURAL_PATTERN,
         name: 'test_feature',
         value: 42.0,
         unit: 'count'
     );
 
-    // Zwei Anomalien mit gleichem Typ und BehaviorType, aber unterschiedlicher Konfidenz
+    // Zwei Anomalien mit gleichem Typ und FeatureType, aber unterschiedlicher Konfidenz
     $anomaly1 = new AnomalyDetection(
         type: AnomalyType::STATISTICAL_ANOMALY,
-        behaviorType: BehaviorType::PATH_PATTERNS,
+        featureType: FeatureType::STRUCTURAL_PATTERN,
         confidence: Percentage::from(60.0),
         anomalyScore: 0.6,
         description: 'Anomaly 1',
@@ -292,7 +307,7 @@ test('dedupliziert und sortiert Anomalien', function () {
 
     $anomaly2 = new AnomalyDetection(
         type: AnomalyType::STATISTICAL_ANOMALY,
-        behaviorType: BehaviorType::PATH_PATTERNS,
+        featureType: FeatureType::STRUCTURAL_PATTERN,
         confidence: Percentage::from(80.0),
         anomalyScore: 0.8,
         description: 'Anomaly 2',
@@ -303,7 +318,7 @@ test('dedupliziert und sortiert Anomalien', function () {
     // Eine Anomalie mit anderem Typ
     $anomaly3 = new AnomalyDetection(
         type: AnomalyType::CLUSTERING_DEVIATION,
-        behaviorType: BehaviorType::PATH_PATTERNS,
+        featureType: FeatureType::STRUCTURAL_PATTERN,
         confidence: Percentage::from(70.0),
         anomalyScore: 0.4,
         description: 'Anomaly 3',
@@ -311,8 +326,8 @@ test('dedupliziert und sortiert Anomalien', function () {
         evidence: ['value' => 42.0, 'expected_value' => 10.0]
     );
 
-    $extractor = createMockExtractorMLE(true, BehaviorType::PATH_PATTERNS, [$feature]);
-    $detector = createMockDetectorMLE(true, [BehaviorType::PATH_PATTERNS], [$anomaly1, $anomaly2, $anomaly3]);
+    $extractor = createMockExtractorMLE(true, FeatureType::STRUCTURAL_PATTERN, [$feature]);
+    $detector = createMockDetectorMLE(true, [FeatureType::STRUCTURAL_PATTERN], [$anomaly1, $anomaly2, $anomaly3]);
 
     $engine = new MachineLearningEngine(
         enabled: true,
@@ -359,7 +374,7 @@ test('gibt Konfiguration korrekt zurück', function () {
     // Assert
     expect($config)->toBeArray();
     expect($config['enabled'])->toBeTrue();
-    expect($config['analysis_timeout_ms'])->toBe(5000);
+    expect($config['analysis_timeout_ms'])->toBe(5000.0);
     expect($config['confidence_threshold'])->toBe(75.0);
     expect($config['enable_parallel_processing'])->toBeTrue();
     expect($config['enable_feature_caching'])->toBeFalse();
@@ -370,8 +385,9 @@ test('gibt Konfiguration korrekt zurück', function () {
 
 test('fängt Ausnahmen ab und gibt Fehlermeldung zurück', function () {
     // Arrange
-    $extractor = Mockery::mock(FeatureExtractorInterface::class);
+    $extractor = Mockery::mock(WafFeatureExtractor::class, FeatureExtractorMetadata::class);
     $extractor->shouldReceive('isEnabled')->andReturn(true);
+    $extractor->shouldReceive('getFeatureType')->andReturn(FeatureType::STRUCTURAL_PATTERN);
     $extractor->shouldReceive('getPriority')->andReturn(10);
     $extractor->shouldReceive('canExtract')->andReturn(true);
     $extractor->shouldReceive('extractFeatures')->andThrow(new \RuntimeException('Test exception'));
@@ -389,7 +405,9 @@ test('fängt Ausnahmen ab und gibt Fehlermeldung zurück', function () {
     $result = $engine->analyzeRequest(createSampleRequestData());
 
     // Assert
-    expect($result->error)->toBe('Test exception');
+    // Individual extractor exceptions don't propagate to top-level error
+    // They're caught and logged to extractorResults
+    expect($result->error)->toBeNull();
     expect($result->features)->toBeEmpty();
     expect($result->anomalies)->toBeEmpty();
 });