fix: add HTTP parse error counter and surface in summary (#17)

[Zious11]

Summary

• Change parse_one_request/parse_one_response return type from Result<_, ()> to Result<_, httparse::Error> to preserve error variant information
• Add aggregate parse_errors: u64 counter to HttpAnalyzer, surfaced in summarize() output
• Generate a Finding for httparse::Error::TooManyHeaders (Anomaly, Inconclusive, Medium confidence, MITRE T1499.002 — Service Exhaustion Flood)
• Other httparse error variants increment counter only (malformed traffic, not specific attacks)

Closes #17

Test plan

• test_parse_error_increments_counter — malformed request increments counter, no finding generated
• test_parse_error_in_summarize — counter appears in summarize() detail map
• test_too_many_headers_generates_finding — 97-header request triggers finding with correct fields
• test_too_many_headers_in_response_generates_finding — response path finding with "response" evidence
• test_parse_error_in_response — malformed response increments counter, no finding
• test_parse_error_clears_buffer_and_continues — buffer cleared on error, subsequent valid request parses
• test_multiple_parse_errors_accumulate — counter correctly accumulates across multiple errors
• test_normal_request_no_parse_errors — valid request: zero errors, no findings
• All 22 http_analyzer_tests pass, 97 total tests pass
• clippy clean, fmt clean

[Copilot]

Pull request overview

This PR enhances the HTTP stream analyzer to preserve httparse::Error variants, track an aggregate parse-error counter, and surface that counter in summarize(), with a specific security Finding emitted for TooManyHeaders (DoS/header-flood signal).

Changes:

• Change parse_one_request / parse_one_response to return Result<_, httparse::Error> instead of collapsing errors to ().
• Add parse_errors: u64 to HttpAnalyzer, expose it via parse_error_count(), and include it in summarize() detail output.
• Generate an Anomaly finding for httparse::Error::TooManyHeaders; add tests covering counter behavior and the finding.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/analyzer/http.rs	Preserve httparse::Error, increment/emit parse-error signals, and surface parse_errors in summary output.
tests/http_analyzer_tests.rs	Add targeted tests for parse-error counting, summary surfacing, TooManyHeaders finding, and recovery behavior.
docs/superpowers/specs/2026-04-06-http-parse-error-design.md	Spec describing the intended behavior and rationale for parse error handling.
docs/superpowers/plans/2026-04-06-http-parse-error.md	Implementation plan/checklist for the change set.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.