Phase 10: Build suspicious lookup review and source detail

[rpmoore]

Roadmap step 85 from docs/steps.md.

Scope

Build suspicious lookup review and source detail.

Details

Group suspicious events by observed source, show classifier reason/severity/window/version, link to source timelines, show blocked/allowed breakdowns, and make observed-source identity limitations visible.

References

• docs/steps.md Phase 10, step 85
• docs/plan/06-admin-api-ui.md#ui-screens
• docs/plan/02-resolver-cache.md#suspicious-lookup-classification
• docs/plan/07-operations-testing.md#security-considerations