feat(tickets): open, comment and resolve tickets from the UI and MCP; known issues on alerts and anomalies (#6351, #6352)

A ticket records a known problem: title, area, hosts, subject, description,
links to alert rules and anomalies, and a log of comments, edits, resolving
and reopening. Opening, resolving (with the resolution as the note) and
reopening go on the timeline; every step is audited, and the audit rows stay
off the timeline.

An alert or anomaly an open ticket covers (by link, by subject, or a
host-wide ticket on the host itself) shows a Known issue badge, and offers
"Open a ticket" prefilled from its rule or anomaly when none does. Hosts,
monitors and containers get a Known issues card.

MCP: list_tickets, get_ticket (viewer); open_ticket, update_ticket,
comment_ticket, resolve_ticket, reopen_ticket (operator). list_alerts and
list_anomalies carry known_issue; get_overview, get_host, get_monitor and
get_container carry open_tickets. Also update_change and delete_change for
changes recorded by hand (author or admin).

Tickets are left out of backups, like the timeline (2026-10-15 ruling).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/tools/monitors.py

@@ -16,6 +16,7 @@ from ._audit import audit_mcp
 from ._shape import (
     age_s, bounded, clamp_limit, db_session, iso, now_utc, pick, redact_url, rnd,
 )
+from .tickets import open_tickets_for
 
 _STATES = ("up", "down", "pending", "disabled")
 
@@ -126,6 +127,7 @@ async def get_monitor(monitor: str, failures: int = 10) -> dict:
     often it runs; `interval_from` says whether that is its own setting
     ("monitor") or the global monitors interval it follows ("global").
     Header values in an HTTP monitor's configuration are redacted.
+    `open_tickets` are the open tickets about it (list_tickets).
     """
     failures = clamp_limit(failures, 10, 50)
     async with db_session() as db:
@@ -133,11 +135,13 @@ async def get_monitor(monitor: str, failures: int = 10) -> dict:
         m = pick(monitor, monitors, kind="monitor", list_tool="list_monitors")
         st = (await monitor_svc.monitor_states(db, [m]))[m.id]
         failed = await monitor_svc.recent_failures(db, m.id, failures)
+        tickets = await open_tickets_for(db, subject=m.name)
     return {
         **_row(m, st, host_names),
         **_interval(m),
         "config": _config(m),
         "heartbeat": "".join("+" if r.is_up else "-" for r in st["recent"]),
+        "open_tickets": tickets,
         "recent_failures": [
             {
                 "checked_at": iso(r.checked_at),