Fix some blocked/allow laggards after migrating. Add DuckDB for outstanding analyitcs performance. Start adding an import for all bot networks

app/models/rule.rb

@@ -7,7 +7,7 @@
 class Rule < ApplicationRecord
   # Rule enums (prefix needed to avoid rate_limit collision)
   # Canonical WAF action order - aligned with Agent and Event models
-  enum :waf_action, { deny: 0, allow: 1, redirect: 2, challenge: 3, log: 4 }, prefix: :action
+  enum :waf_action, { deny: 0, allow: 1, redirect: 2, challenge: 3, log: 4, add_header: 5 }, prefix: :action
   enum :waf_rule_type, { network: 0, rate_limit: 1, path_pattern: 2 }, prefix: :type
 
   SOURCES = %w[manual auto:scanner_detected auto:rate_limit_exceeded auto:bot_detected imported default manual:surgical_block manual:surgical_exception policy].freeze
@@ -120,6 +120,10 @@ class Rule < ApplicationRecord
     action_challenge?
   end
 
+  def add_header_action?
+    action_add_header?
+  end
+
   # Redirect/challenge convenience methods
   def redirect_url
     metadata_hash['redirect_url']
@@ -137,6 +141,14 @@ class Rule < ApplicationRecord
     metadata&.dig('challenge_message')
   end
 
+  def header_name
+    metadata&.dig('header_name')
+  end
+
+  def header_value
+    metadata&.dig('header_value')
+  end
+
   def related_surgical_rules
     if surgical_block?
       # Find the corresponding exception rule
@@ -421,6 +433,12 @@ class Rule < ApplicationRecord
     if source&.start_with?('auto:') || source == 'default'
       self.user ||= User.find_by(role: 1) # admin role
     end
+
+    # Set default header values for add_header action
+    if add_header_action?
+      self.metadata['header_name'] ||= 'X-Bot-Agent'
+      self.metadata['header_value'] ||= 'Unknown'
+    end
   end
 
   def calculate_priority_for_network_rules
@@ -504,6 +522,13 @@ class Rule < ApplicationRecord
       if challenge_type_value && !%w[captcha javascript proof_of_work].include?(challenge_type_value)
         errors.add(:metadata, "challenge_type must be one of: captcha, javascript, proof_of_work")
       end
+    when "add_header"
+      unless metadata&.dig("header_name").present?
+        errors.add(:metadata, "must include 'header_name' for add_header action")
+      end
+      unless metadata&.dig("header_value").present?
+        errors.add(:metadata, "must include 'header_value' for add_header action")
+      end
     end
   end