revert: undo service badge filter, parser normalization, and SSH relay

Reverts commits 8c249f6, a6c7cfd, 7ff5703. The SSH log relay approach
requires container redeployment and doesn't retroactively fix existing
attacker profiles. Rolling back to reassess the approach.

decnet/collector/worker.py

@@ -24,7 +24,7 @@ _RFC5424_RE = re.compile(
     r"(\S+) "       # 1: TIMESTAMP
     r"(\S+) "       # 2: HOSTNAME (decky name)
     r"(\S+) "       # 3: APP-NAME (service)
-    r"\S+ "         # PROCID (NILVALUE or PID)
+    r"- "           # PROCID always NILVALUE
     r"(\S+) "       # 4: MSGID (event_type)
     r"(.+)$",       # 5: SD element + optional MSG
 )
@@ -33,8 +33,6 @@ _PARAM_RE = re.compile(r'(\w+)="((?:[^"\\]|\\.)*)"')
 _IP_FIELDS = ("src_ip", "src", "client_ip", "remote_ip", "ip")
 
 
-
-
 def parse_rfc5424(line: str) -> Optional[dict[str, Any]]:
     """
     Parse an RFC 5424 DECNET log line into a structured dict.

decnet/correlation/parser.py

@@ -26,7 +26,7 @@ _RFC5424_RE = re.compile(
     r"(\S+) "       # 1: TIMESTAMP
     r"(\S+) "       # 2: HOSTNAME (decky name)
     r"(\S+) "       # 3: APP-NAME (service)
-    r"\S+ "         # PROCID (NILVALUE or PID)
+    r"- "           # PROCID always NILVALUE
     r"(\S+) "       # 4: MSGID (event_type)
     r"(.+)$",       # 5: SD element + optional MSG
 )
@@ -41,7 +41,6 @@ _PARAM_RE = re.compile(r'(\w+)="((?:[^"\\]|\\.)*)"')
 _IP_FIELDS = ("src_ip", "src", "client_ip", "remote_ip", "ip")
 
 
-
 @dataclass
 class LogEvent:
     """A single parsed event from a DECNET syslog line."""
@@ -100,7 +99,6 @@ def parse_line(line: str) -> LogEvent | None:
         return None
 
     fields = _parse_sd_params(sd_rest)
-
     attacker_ip = _extract_attacker_ip(fields)
 
     return LogEvent(