Parse morgan logs, cut REC emit latency, VIP for suspicious

Express/morgan access logs now parse for HTTP identity so REC correlates captured responses instead of parking them at SUSPICIOUS. Reduced REC reassembly emit latency (idle 250ms, ticker 200ms). Extended VIP pinning to suspicious cache hits.