Replace CSV traffic log with SQLite for better performance

- traffic_log.csv → traffic_log.db (SQLite with indexed timestamp)
- INSERT instead of CSV append, DELETE instead of file rewrite
- CLI queries use SQL (GROUP BY for traffic, LIMIT for log)
- retrain_from_log() uses read-only connection with time range query
- Config key: traffic_log_file → traffic_log_db

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

config/config.yaml

@@ -71,5 +71,5 @@ ai:
   training_data_file: /var/lib/xdp-defense/training_data.csv
 
   # Traffic logging
-  traffic_log_file: /var/lib/xdp-defense/traffic_log.csv
+  traffic_log_db: /var/lib/xdp-defense/traffic_log.db
   traffic_log_retention_days: 7  # days to keep traffic log data