feat(iwooos): classify Wazuh dashboard readback degradation

apps/api/tests/test_telegram_message_templates.py

@@ -164,6 +164,32 @@ syscheck integrity changed on /etc/nginx/sites-enabled/awoooi.conf
     assert "super-secret" not in result
 
 
+def test_wazuh_dashboard_api_degraded_alert_becomes_readback_gap_event_packet() -> None:
+    """Wazuh Dashboard/API mismatch 必須轉成讀回退化事件卡，不可誤報成已修復。"""
+    raw_alert = """
+wazuh_dashboard_api_readback_degraded dashboard agent list disappeared
+POST /api/check-stored-api status=429 POST /api/check-api status=500
+https://127.0.0.1:55000 is unreachable manager registry readback blocked
+full_log=/var/ossec/logs/alerts/alerts.json Authorization: Bearer abcdefghijklmnopqrstuvwxyz
+"""
+
+    result = format_aiops_signal_alert_card(raw_alert)
+
+    assert "P1 AIOps 訊號｜Wazuh Dashboard / API 讀回退化" in result
+    assert "ai_automation_alert_card_v1" in result
+    assert "wazuh_dashboard_api_readback_degraded" in result
+    assert "siem_observability_readback_degraded" in result
+    assert "candidate_only" in result
+    assert "runtime_write_gate=0" in result
+    assert "manager registry 只讀計數" in result
+    assert "no-false-green" in result
+    assert "不重啟 Wazuh" in result
+    assert "不重新註冊 agent" in result
+    assert "127.0.0.1:55000" not in result
+    assert "/var/ossec" not in result
+    assert "abcdefghijkl" not in result
+
+
 def test_nginx_drift_alert_becomes_public_gateway_event_packet() -> None:
     """Nginx drift 應進 Public Gateway gate，而不是直接要求 reload。"""
     raw_alert = """