[AlyaGomaa]

Sub-PR of #2141: part 2 of 12. The parent PR stays open and unchanged; this PR carries one feature of it so it can be reviewed on its own.

What this PR adds

• Flow retention for live captures (flow_retention in config/slips.yaml): SQLite prunes the oldest raw flows by age and size and protects flows linked to evidence.
• Detection history (detection_history.py, detection_queries.py): old detections are archived and rotated, hourly summaries are kept, maintenance yields to capture.
• Flows are written in batches (add_flows); detector flow lookups use composite indexes.
• Evidence is stored in SQLite before it is published; processed evidence scores are stored; scoring checks an alert index instead of loading past alerts.
• ICMP evidence keeps type and code (is_icmp_protocol, normalize_icmp_evidence).
• Log rotation helper for slips.log and evidence logs (log_rotation.py); accepted evidence is drained before workers stop.

Where it sits in the split

• Chain: part 2 of 12. Review and merge in order.
• Base: sebas/feat/native_macos_rpi_runtime (Run Slips natively on macOS and Raspberry Pi #2198), so the diff shows only this PR's changes. GitHub retargets it to develop when Run Slips natively on macOS and Raspberry Pi #2198 merges.
• Next: Persist host identity across runs and networks #2200.
• Size: 39 files, +4852 / -224 lines (tests are +2274 of them).
• Built from parent head 8d6533186.

Notes for review

• Holds the shared database and evidence changes that sub-PRs 2, 5, 6, 9 and 11 build on.

Tests

• Unit suite on this branch (local, pytest tests/unit -n 3): 3572 passed, 2 skipped, 0 failed. Integration tests were not run locally.