feat(tickets): open, comment and resolve tickets from the UI and MCP; known issues on alerts and anomalies (#6351, #6352)

A ticket records a known problem: title, area, hosts, subject, description,
links to alert rules and anomalies, and a log of comments, edits, resolving
and reopening. Opening, resolving (with the resolution as the note) and
reopening go on the timeline; every step is audited, and the audit rows stay
off the timeline.

An alert or anomaly an open ticket covers (by link, by subject, or a
host-wide ticket on the host itself) shows a Known issue badge, and offers
"Open a ticket" prefilled from its rule or anomaly when none does. Hosts,
monitors and containers get a Known issues card.

MCP: list_tickets, get_ticket (viewer); open_ticket, update_ticket,
comment_ticket, resolve_ticket, reopen_ticket (operator). list_alerts and
list_anomalies carry known_issue; get_overview, get_host, get_monitor and
get_container carry open_tickets. Also update_change and delete_change for
changes recorded by hand (author or admin).

Tickets are left out of backups, like the timeline (2026-10-15 ruling).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/tools/alerts.py

@@ -10,6 +10,7 @@ from steward.core import outbox
 from steward.mcp._context import current_caller, mcp_app
 from steward.models.alerts import AlertOperator, AlertRule, AlertState, MaintenanceWindow
 from steward.models.users import UserRole
+from steward.tickets.service import known_issues
 
 from ._audit import audit_mcp, mcp_username
 from ._shape import (
@@ -44,13 +45,17 @@ async def list_alerts() -> dict:
     (no sample for three of its usual gaps, at least 5 minutes); a firing
     alert that goes silent stays "firing" with `no_data_since` set. Each
     carries the rule's condition, the resource and metric it watches, `since`
-    (its latest state change) and `last_sample_at`. Firing, unacknowledged
-    alerts come first. An alert that cleared is not here; get_alert_history
-    shows the transitions.
+    (its latest state change), `last_sample_at`, and `known_issue`: the open
+    tickets covering it (get_ticket says what is known and tried). Firing,
+    unacknowledged alerts come first. An alert that cleared is not here;
+    get_alert_history shows the transitions.
     """
     async with db_session() as db:
         active = await alert_svc.active_alerts(db)
         names = await alert_svc.usernames(db, (s.acknowledged_by for s, _ in active))
+        known = await known_issues(db, {
+            rule.id: ([("alert_rule", rule.id), ("alert_rule", rule.parent_id or "")], rule.resource_name)
+            for _, rule in active})
     order = {"firing": 0, "no_data": 1, "pending": 2, "acknowledged": 3}
     rows = [
         {
@@ -67,6 +72,7 @@ async def list_alerts() -> dict:
             "age_s": age_s(state.last_transition_at),
             "acknowledged_by": names.get(state.acknowledged_by) if state.acknowledged_by else None,
             "acknowledged_at": iso(state.acknowledged_at),
+            "known_issue": [{"ticket": t.id, "title": t.title} for t in known.get(rule.id, [])],
         }
         for state, rule in active
     ]