[Feat]: netflow.plugin: emit user-defined flow rollups as metrics (enables alerting + ML)

Problem

Users want to be notified when netflow traffic does something clearly abnormal. For eg. a sudden spike in traffic from a specific country.

Based on the analysis done so far: On the data side the plugin already has what it needs. The flows:netflow function decodes, enriches with GeoIP, and stores flows in the multi-tier journal. We can already query group_by: SRC_COUNTRY and filter SRC_COUNTRY: IR. The gap is that this only lives in the interactive function. There is no way to pin an aggregation as a standard metric.

Description

We need to add a config-driven aggregation layer to netflow.plugin that emits user-defined flow rollups as standard Netdata metrics. So "bytes/s from X" (or per-country, across all countries) becomes a normal chart.

Once these are standard metrics, the rest comes for free. Alerting works exactly as it does on any other metric. ML also picks them up automatically through the per-metric k-means models, so users get anomaly detection on traffic patterns without us building anything ML-specific.

Out of scope for now: ML deriving anomalies straight from raw flows with no user-defined rules. We don't have an approach for that yet. This issue is the rule-based path, which covers most of what the customers asked for.

Importance

really want

Value proposition

Make netflow functionality in Netdata more operationally useful.

Proposed implementation

No response