fix(security): persist scheduled Wazuh lifecycle defaults

apps/api/tests/test_wazuh_alertmanager_integration.py

@@ -464,6 +464,8 @@ async def test_wazuh_scheduled_incident_bind_is_idempotent_and_public_safe(
                 "alertname": "WazuhAlertmanagerIntegrationConvergence",
                 "notification_type": "TYPE-5S",
                 "alert_category": "security",
+                "ttl_days": 7,
+                "vectorized": False,
                 "signal_count": 1,
                 "affected_service_count": 2,
             }
@@ -496,6 +498,9 @@ async def test_wazuh_scheduled_incident_bind_is_idempotent_and_public_safe(
     inserted = calls[0][1]
     assert inserted["notification_type"] == "TYPE-5S"
     assert inserted["severity"] == "P1"
+    assert inserted["ttl_days"] == 7
+    assert inserted["vectorized"] is False
+    assert "ttl_days, vectorized" in calls[0][0]
     encoded = json.dumps(inserted, default=str, sort_keys=True)
     assert "sensor-agent" in encoded
     assert "raw" not in encoded.lower()