feat(tickets): open, comment and resolve tickets from the UI and MCP; known issues on alerts and anomalies (#6351, #6352)

A ticket records a known problem: title, area, hosts, subject, description,
links to alert rules and anomalies, and a log of comments, edits, resolving
and reopening. Opening, resolving (with the resolution as the note) and
reopening go on the timeline; every step is audited, and the audit rows stay
off the timeline.

An alert or anomaly an open ticket covers (by link, by subject, or a
host-wide ticket on the host itself) shows a Known issue badge, and offers
"Open a ticket" prefilled from its rule or anomaly when none does. Hosts,
monitors and containers get a Known issues card.

MCP: list_tickets, get_ticket (viewer); open_ticket, update_ticket,
comment_ticket, resolve_ticket, reopen_ticket (operator). list_alerts and
list_anomalies carry known_issue; get_overview, get_host, get_monitor and
get_container carry open_tickets. Also update_change and delete_change for
changes recorded by hand (author or admin).

Tickets are left out of backups, like the timeline (2026-10-15 ruling).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/tools/anomalies.py

@@ -45,6 +45,7 @@ def _row(v: anom.AnomalyView) -> dict:
         "reviewed_at": iso(a.reviewed_at),
         "note": a.note,
         "page": v.href,
+        "known_issue": [{"ticket": t.id, "title": t.title} for t in v.tickets],
     }
 
 
@@ -64,7 +65,8 @@ async def list_anomalies(review: str = "to_review", limit: int = 50) -> dict:
     `usual_hold` (the level that hour usually holds) and `usual_peak` (how high
     it usually goes), all in the metric's own unit. `ongoing` is true while an
     occurrence is still going. To-review rows come first, newest occurrence
-    first. review_anomaly marks one.
+    first. `known_issue` lists the open tickets covering it. review_anomaly
+    marks one; open_ticket keeps a real one's notes until it is fixed.
     """
     if review and review not in anom.REVIEWS:
         raise ValueError(f"review must be one of {', '.join(anom.REVIEWS)}, or empty for all")