feat(anomaly): sentinel/cluster failover event tracking with slowlog correlation

[SBALAVIGNESH123]

Summary

Implements Issue #28 — Sentinel/Cluster failover event tracking with slowlog correlation.

This PR adds end-to-end failover detection, persistence, and correlation to the anomaly detection pipeline, enabling post-incident analysis of failover events alongside slowlog spikes.

Changes

Shared Types (packages/shared)

• Added FAILOVER_STARTED and FAILOVER_COMPLETED to WebhookEventType enum
• Registered both as PRO tier events in WEBHOOK_EVENT_TIERS and PRO_EVENTS
• Extended IWebhookEventsProService interface with dispatchFailoverStarted() and dispatchFailoverCompleted()

Anomaly Detection (proprietary/anomaly-detection)

• Added CLUSTER_STATE to MetricType enum
• Replication role detection now tracks both directions:
  • master -> replica demotion: CRITICAL / DROP + failover.started webhook
  • replica -> master promotion: WARNING / SPIKE + failover.completed webhook
• Cluster state tracking: detects ok -> fail and fail -> ok transitions via CLUSTER INFO
• Excluded CLUSTER_STATE from z-score buffer loop (handled via state-change detection)
• Added lastClusterState cleanup in onConnectionRemoved()
• Injected WebhookEventsProService (optional, PRO-only)

Correlation Engine

• Enhanced NODE_FAILOVER pattern rule with optionalMetrics: [SLOWLOG_LAST_ID, CLUSTER_STATE, OPS_PER_SEC]
• Added dedicated CLUSTER_STATE -> NODE_FAILOVER pattern rule
• Added enrichDiagnosis() method that dynamically includes slowlog correlation context when SLOWLOG_LAST_ID co-occurs with failover events in the same 5s window

Webhook PRO Service

• Added dispatchFailoverStarted() and dispatchFailoverCompleted() methods with license gating

Testing

• 50 unit tests pass across correlator.spec.ts, spike-detector.spec.ts, metric-buffer.spec.ts
• 8 new tests covering promotion detection, webhook dispatch, CLUSTER_STATE correlation, slowlog-failover co-occurrence diagnosis enrichment, buffer exclusion, and state cleanup
• packages/shared compiles cleanly with tsc --noEmit
• Zero regression on all existing tests

Closes #28

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[SBALAVIGNESH123]

I have read the CLA Document and I hereby sign the CLA

[SBALAVIGNESH123]

recheck

[KIvanow]

dispatchClusterFailover is never called in the new cluster state detection path, even though it exists for exactly this case and all required data (slotsAssigned, slotsFailed, knownNodes) is in the getClusterInfo response already in scope.

The pre-existing dispatchClusterFailover exists specifically to fire a webhook when cluster state changes (ok→fail, fail→ok), carrying clusterState, previousState, slotsAssigned, slotsFailed, knownNodes. The new cluster state detection code (lines 390–426 of anomaly.service.ts) creates the anomaly event correctly but never calls dispatchClusterFailover. All the information needed for the payload is available right there -getClusterInfo is already called and its response contains the slot counts. So a fail transition fires a CRITICAL anomaly but no webhook, while the equivalent replication role demotion fires both.

[KIvanow]

First, I want to thank you for your contribution @SBALAVIGNESH123 !

There is only one issue that needs to be adressed before this can be merged - https://github.com/BetterDB-inc/monitor/pull/142/changes#r3172532439

And some conflicts with the main branch due to other PRs being merged

[SBALAVIGNESH123]

Thanks for the review @KIvanow! Great catch — I've addressed the feedback:

Fix: Added dispatchClusterFailover() call in the cluster state detection path (lines 421–435 of �nomaly.service.ts). The webhook now fires on both ok→fail and ail→ok transitions, carrying clusterState, previousState, slotsAssigned, slotsFailed, and knownNodes from the getClusterInfo response that was already in scope.

Test: Added a new test (dispatches cluster.failover webhook on ok→fail transition) that verifies the webhook payload is correct.

Merge conflicts: Resolved — kept both our FAILOVER_STARTED/FAILOVER_COMPLETED events and the upstream INFERENCE_SLA_BREACH event in packages/shared/src/webhooks/types.ts.

[SBALAVIGNESH123]

recheck

[KIvanow]

This looks great @SBALAVIGNESH123 Could you please sign your commits so I can merge them?

[SBALAVIGNESH123]

Hey @KIvanow, thanks for the heads up! I've signed the commit — it should now show as verified. Let me know if there's anything else needed for the merge!