Support JSON log input (structured log parsing)

[bad-antics]

Description

Many modern services output structured JSON logs (Docker, systemd journal export, cloud services). LogReaper should be able to parse JSON log lines in addition to traditional syslog format.

Use Case

{"timestamp":"2026-01-15T10:23:45Z","level":"error","msg":"authentication failed","user":"admin","src_ip":"192.168.1.100"}

LogReaper should detect the auth failure pattern from structured fields, not just regex on the raw line.

Proposed Approach

• Auto-detect JSON lines (starts with {)
• Extract common fields: timestamp, message/msg, level/severity, source/src_ip
• Apply detection patterns to the message field
• Use a lightweight JSON parser (no external deps — hand-rolled or single-header like cJSON)

Acceptance Criteria

• LogReaper detects and parses JSON log lines
• Detection patterns work on extracted message content
• Mixed format logs (some JSON, some syslog) handled gracefully
• No new external dependencies