feat(api): support traffic bytes tracking in edge access logs and refactor analytics models

- Add `bytes_sent` to `NodeAccessLog` on both Agent and Master Server.
- Create ClickHouse migration `202607120001_add_bytes_sent_to_node_access_logs.sql`.
- Refactor duplicate stats structs by centralizing them into `analyticsmodel` package with type aliases.
- Simplify access log store delegations and remove redundant mapping loops.
- Regenerate Swagger documentation.
- Update changelog index.md.

internal/model/analytics/node_access_log.go

@@ -10,7 +10,7 @@ import (
 
 const (
 	nodeAccessLogTableName     = "of_node_access_logs"
-	nodeAccessLogInsertColumns = "id, node_id, logged_at, remote_addr, region, host, path, status_code, created_at"
+	nodeAccessLogInsertColumns = "id, node_id, logged_at, remote_addr, region, host, path, status_code, bytes_sent, created_at"
 )
 
 // NodeAccessLog stores OpenFlare edge node access records in ClickHouse.
@@ -23,6 +23,7 @@ type NodeAccessLog struct {
 	Host       string    `gorm:"column:host"`
 	Path       string    `gorm:"column:path"`
 	StatusCode int32     `gorm:"column:status_code"`
+	BytesSent  uint64    `gorm:"column:bytes_sent"`
 	CreatedAt  time.Time `gorm:"column:created_at"`
 }
 
@@ -39,4 +40,4 @@ func (NodeAccessLog) InsertColumns() string {
 // BatchInsertSQL returns the INSERT prefix used by native batch writers.
 func (NodeAccessLog) BatchInsertSQL() string {
 	return fmt.Sprintf("INSERT INTO %s (%s)", nodeAccessLogTableName, nodeAccessLogInsertColumns)
-}
+}

internal/model/analytics/node_access_log_stats.go

@@ -0,0 +1,58 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package analytics
+
+// NodeAccessLogBucketAggregate is a folded bucket aggregate row.
+type NodeAccessLogBucketAggregate struct {
+	BucketEpoch      int64 `gorm:"column:bucket_epoch"`
+	RequestCount     int64 `gorm:"column:request_count"`
+	SuccessCount     int64 `gorm:"column:success_count"`
+	ClientErrorCount int64 `gorm:"column:client_error_count"`
+	ServerErrorCount int64 `gorm:"column:server_error_count"`
+	UniqueIPCount    int64 `gorm:"column:unique_ip_count"`
+	UniqueHostCount  int64 `gorm:"column:unique_host_count"`
+	BytesSent        int64 `gorm:"column:bytes_sent"`
+}
+
+// NodeAccessLogWAFIPAggregate is a per-IP aggregate row for WAF automatic rules.
+type NodeAccessLogWAFIPAggregate struct {
+	RemoteAddr       string
+	RequestCount     int64
+	Status404Count   int64
+	ClientErrorCount int64
+	ServerErrorCount int64
+	IPHostCount      int64
+	LastSeenEpoch    int64
+	StatusCounts     map[int]int64
+}
+
+// NodeAccessLogBucketDimension is a bucket dimension value.
+type NodeAccessLogBucketDimension struct {
+	BucketEpoch int64  `gorm:"column:bucket_epoch"`
+	Value       string `gorm:"column:value"`
+}
+
+// NodeAccessLogIPAggregate is an IP aggregate row.
+type NodeAccessLogIPAggregate struct {
+	RemoteAddr       string `gorm:"column:remote_addr"`
+	RequestCount     int64  `gorm:"column:request_count"`
+	SuccessCount     int64  `gorm:"column:success_count"`
+	ClientErrorCount int64  `gorm:"column:client_error_count"`
+	ServerErrorCount int64  `gorm:"column:server_error_count"`
+	LastSeenEpoch    int64  `gorm:"column:last_seen_epoch"`
+}
+
+// NodeAccessLogIPSummary is an IP summary row.
+type NodeAccessLogIPSummary struct {
+	RemoteAddr     string `gorm:"column:remote_addr"`
+	TotalRequests  int64  `gorm:"column:total_requests"`
+	RecentRequests int64  `gorm:"column:recent_requests"`
+	LastSeenEpoch  int64  `gorm:"column:last_seen_epoch"`
+}
+
+// NodeAccessLogIPTrend is an IP trend bucket row.
+type NodeAccessLogIPTrend struct {
+	BucketEpoch  int64 `gorm:"column:bucket_epoch"`
+	RequestCount int64 `gorm:"column:request_count"`
+}