fix: use lowercase JSON keys matching CrowdSec's real alert schema

CrowdSec's notification-http plugin serializes alerts with lowercase
keys (source/ip/cn/scenario), not the PascalCase (Source/IP/Cn/Scenario)
this code was reading. Every lookup silently fell through to its
default value, so every notification showed 'unknown' regardless of
the real IP, country or scenario. Confirmed by capturing a real payload.

app.py

@@ -72,9 +72,9 @@ def handle_crowdsec():
         # Group by IP
         ip_groups = {}
         for alert in alerts:
-            ip = alert.get("Source", {}).get("IP", "unknown")
-            country = alert.get("Source", {}).get("Cn", "")
-            scenario = alert.get("Scenario", "unknown")
+            ip = alert.get("source", {}).get("ip", "unknown")
+            country = alert.get("source", {}).get("cn", "")
+            scenario = alert.get("scenario", "unknown")
             
             if ip not in ip_groups:
                 ip_groups[ip] = {"country": country, "scenarios": set()}