perf: add occurred_at indexes to connections

Time-window queries (dashboard stats, recent connections, JSON API,
purge) had no usable index and full-scanned the connections table on
every load, so the dashboard slowed down as data accumulated.

- Add idx_occurred (occurred_at) for counts, MAX, ORDER BY ... LIMIT,
  and the purge delete
- Add idx_src_ip_occ (src_ip, occurred_at) so frequent_ips() runs as a
  covering index scan
- Drop the now-redundant standalone idx_src_ip

Migrations in setup.php are idempotent (information_schema checks) and
portable across MySQL 8 and MariaDB.

README.md

@@ -225,7 +225,7 @@ One row per connection event ingested from any node.
 | `banner_len` | `INT UNSIGNED` | Length of the banner in bytes |
 | `created_at` | `DATETIME` | Row insertion time |
 
-**Indexes:** `(node_id, occurred_at)` for cursor lookups and per-node queries; `src_ip` and `dst_port` for the top-N aggregations.
+**Indexes:** `(node_id, occurred_at)` for cursor lookups and per-node queries; `occurred_at` for time-window queries, the recent-connections sort, and the purge; `(src_ip, occurred_at)` for the frequent-IP aggregation; `dst_port` for the top-port aggregation.
 
 ---
 
@@ -507,7 +507,7 @@ If you deployed before `last_event_at` was added to the schema, run `setup.php`
 php /var/www/portspoof_concentrator/setup.php
 ```
 
-It will add the missing column and drop the legacy `uq_event` unique key if present. No data is lost.
+It will add the missing column, drop the legacy `uq_event` unique key, and add the `occurred_at` / `(src_ip, occurred_at)` indexes if present. No data is lost.
 
 ---