feat(1c): add file-based analytics stack scaffold

clickhouse-1c/ops/etl-cron.example

@@ -0,0 +1,5 @@
+# every 6 hours: load exports, rebuild timeline, refresh cases
+0 */6 * * * cd /opt/aw-rus/clickhouse-1c && . .venv/bin/activate && python etl/load_1c_exports.py --config etl/config.yml >> /var/log/aw-rus-1c-etl.log 2>&1
+10 */6 * * * clickhouse-client --queries-file /opt/aw-rus/clickhouse-1c/detections/build_entity_timeline.sql >> /var/log/aw-rus-1c-timeline.log 2>&1
+15 */6 * * * clickhouse-client --queries-file /opt/aw-rus/clickhouse-1c/detections/insert_detections.sql >> /var/log/aw-rus-1c-detections.log 2>&1
+20 */6 * * * clickhouse-client --queries-file /opt/aw-rus/clickhouse-1c/detections/open_cases_from_detections.sql >> /var/log/aw-rus-1c-cases.log 2>&1

clickhouse-1c/ops/retention-policy.md

@@ -0,0 +1,11 @@
+# Retention policy
+
+Минимально разумный retention для файловой 1С analytics stack:
+
+- landing/raw exports: `30` дней
+- archived raw files: `90` дней
+- raw_* в ClickHouse: `30` дней
+- core tables: `365` дней
+- detections/cases/timeline: `365` дней или по регламенту ИБ
+
+Если регуляторика требует больше, меняется отдельно от Grafana UI.