Part 4 — Per-Entity Baselines + Model Persistence (So Your Mini IDS Actually Learns)

Part 3 got you to a deployable pipeline: flow logs in, anomalies out, JSON events shipped.