feat(traffic-flow): enhance flow analytics and IP handling

- Introduced `canonicalIp` function to standardize IP address formats across the application, improving consistency in flow processing.
- Updated traffic flow analytics to utilize new endpoint resolution logic, enhancing accuracy in traffic classification.
- Enhanced tests for traffic flow analytics and IP handling, ensuring comprehensive coverage for new functionalities.
- Improved traffic flow destination resolution with additional test cases for various internet services, including Google and Fastly.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/services/traffic-flow-parse.ts

@@ -1,3 +1,5 @@
+import { canonicalIp } from "./traffic-flow-ip.js"
+
 export interface ParsedFlow {
   src: string
   dst: string
@@ -44,11 +46,13 @@ export function normalizeParsedFlow(flow: ParsedFlowInput): ParsedFlow {
   return {
     ...emptyParsedFlow(),
     ...flow,
-    nextHop: flow.nextHop ?? "",
+    src: canonicalIp(flow.src) || flow.src || "",
+    dst: canonicalIp(flow.dst) || flow.dst || "",
+    nextHop: canonicalIp(flow.nextHop ?? ""),
     flowStartMs: flow.flowStartMs ?? 0,
     flowEndMs: flow.flowEndMs ?? 0,
-    natSrc: flow.natSrc ?? "",
-    natDst: flow.natDst ?? "",
+    natSrc: canonicalIp(flow.natSrc ?? ""),
+    natDst: canonicalIp(flow.natDst ?? ""),
     natSrcPort: flow.natSrcPort ?? 0,
     natDstPort: flow.natDstPort ?? 0,
     inIface: flow.inIface ?? "",