Incident response: SYN flood mitigation

Diagnosed a SYN-flood DDoS via netstat; reduced attack ~75% with kernel tuning (tcp_syncookies, backlog, synack retries), contained with ufw, and resolved with nftables SynProxy. Written up as a published incident retrospective.