- add multi-stage scratch-based Dockerfile with non-root user and mTLS cert support
- add K8s Deployment, Service, ConfigMap, and Secret manifests with security hardening
- bind MONGODB_PASSWORD and SERVICE_SECRET_KEY from environment variables via viper
- restructure deploy/ directory and remove unused modelrt.cnf
- bump Go version to 1.26.3 and add event-flow-analysis doc
- migrate logger to read traceID/spanID from OTel span context instead of ctx string keys
- extract upstream W3C trace context from AMQP headers in processAlarmEventMessage to chain spans across modelRT→eventRT
- add per-message span in processAlarmEventMessage for end-to-end trace visibility