feat(tickets): open, comment and resolve tickets from the UI and MCP; known issues on alerts and anomalies (#6351, #6352)

A ticket records a known problem: title, area, hosts, subject, description,
links to alert rules and anomalies, and a log of comments, edits, resolving
and reopening. Opening, resolving (with the resolution as the note) and
reopening go on the timeline; every step is audited, and the audit rows stay
off the timeline.

An alert or anomaly an open ticket covers (by link, by subject, or a
host-wide ticket on the host itself) shows a Known issue badge, and offers
"Open a ticket" prefilled from its rule or anomaly when none does. Hosts,
monitors and containers get a Known issues card.

MCP: list_tickets, get_ticket (viewer); open_ticket, update_ticket,
comment_ticket, resolve_ticket, reopen_ticket (operator). list_alerts and
list_anomalies carry known_issue; get_overview, get_host, get_monitor and
get_container carry open_tickets. Also update_change and delete_change for
changes recorded by hand (author or admin).

Tickets are left out of backups, like the timeline (2026-10-15 ruling).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -94,6 +94,13 @@ async def entity_labels(db, items: list[dict]) -> dict[tuple[str, str], dict]:
                 labels[(etype, r.id)] = {
                     "label": run_title(r.playbook_path, scopes.get(r.inventory_scope, r.inventory_scope)),
                     "url": f"/ansible/runs/{r.id}", "gone": False}
+        elif etype == "ticket":
+            from steward.models.tickets import Ticket
+            nums = [int(i) for i in wanted if i.isdigit()]
+            for num, title in (await db.execute(
+                    select(Ticket.id, Ticket.title).where(Ticket.id.in_(nums)))).all() if nums else ():
+                labels[(etype, str(num))] = {"label": f"#{num} {title}", "url": f"/tickets/{num}",
+                                             "gone": False}
         elif etype == "timeline_entry":
             from steward.models.timeline import TimelineEntry
             for row_id, summary in (await db.execute(
@@ -215,6 +222,11 @@ ACTIONS = {
     "timeline.change_recorded": "recorded a change:",
     "timeline.change_edited": "edited the recorded change",
     "timeline.change_deleted": "deleted the recorded change",
+    "ticket.opened": "opened ticket",
+    "ticket.edited": "edited ticket",
+    "ticket.commented": "commented on ticket",
+    "ticket.resolved": "resolved ticket",
+    "ticket.reopened": "reopened ticket",
     "backup.made": "sent a backup",
     "backup.failed": "tried to send a backup, which failed:",
     "backup.restored": "restored Steward from a backup",
@@ -227,7 +239,8 @@ AREAS = (("auth.", "Sign-ins"), ("account.", "Accounts"), ("user.", "Users"), ("
          ("ansible.run", "Playbook runs"), ("ansible.", "Ansible (all)"),
          ("settings.", "Settings"), ("plugin.", "Plugins"), ("api_token.", "AI access"),
          ("docker.", "Docker"), ("snmp.", "SNMP"), ("prometheus.", "Prometheus"),
-         ("syslog.", "Syslog"), ("backup.", "Backups"), ("timeline.", "Timeline"))
+         ("syslog.", "Syslog"), ("backup.", "Backups"), ("timeline.", "Timeline"),
+         ("ticket.", "Tickets"))
 
 
 def action_text(action: str) -> str: