Norms first, AI second

AI explains anomalies well, but without port norms it lacks a baseline. Configure NORMAL/DEVIATION/ALARM first, then enable the operator agent.