feat(tickets): open, comment and resolve tickets from the UI and MCP; known issues on alerts and anomalies (#6351, #6352)

A ticket records a known problem: title, area, hosts, subject, description,
links to alert rules and anomalies, and a log of comments, edits, resolving
and reopening. Opening, resolving (with the resolution as the note) and
reopening go on the timeline; every step is audited, and the audit rows stay
off the timeline.

An alert or anomaly an open ticket covers (by link, by subject, or a
host-wide ticket on the host itself) shows a Known issue badge, and offers
"Open a ticket" prefilled from its rule or anomaly when none does. Hosts,
monitors and containers get a Known issues card.

MCP: list_tickets, get_ticket (viewer); open_ticket, update_ticket,
comment_ticket, resolve_ticket, reopen_ticket (operator). list_alerts and
list_anomalies carry known_issue; get_overview, get_host, get_monitor and
get_container carry open_tickets. Also update_change and delete_change for
changes recorded by hand (author or admin).

Tickets are left out of backups, like the timeline (2026-10-15 ruling).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/timeline/catalog.py

@@ -77,6 +77,13 @@ for _t in (
      "What an alert rule watches reported again after a silence."),
     ("change.recorded", "Change recorded", "change", "service", True,
      "A change someone recorded by hand, on the Timeline or a host's page, or through MCP."),
+    # A ticket's entries are written with its own area.
+    ("ticket.opened", "Ticket opened", "ticket", "monitoring", True,
+     "Someone opened a ticket for a known problem."),
+    ("ticket.resolved", "Ticket resolved", "ticket", "monitoring", True,
+     "A ticket was resolved; its resolution is the entry's note."),
+    ("ticket.reopened", "Ticket reopened", "ticket", "monitoring", True,
+     "A resolved ticket was opened again."),
     ("ansible.changed", "Playbook changed something", "automation", "host_os", True,
      "A playbook run finished and changed at least one host."),
     ("ansible.unchanged", "Playbook changed nothing", "automation", "host_os", False,
@@ -149,6 +156,9 @@ _AUDIT_TYPES = (
     ("docker.prune.", None),
     # A change recorded by hand is on the timeline as itself (timeline.changes).
     ("timeline.change", None),
+    # A ticket's opening, resolution and reopening are on the timeline as
+    # themselves (tickets.service); its edits and comments are its own log.
+    ("ticket.", None),
     ("auth.login", "steward.signin"), ("auth.setup", "steward.config"),
     ("account.", "steward.access"), ("user.", "steward.access"), ("api_token.", "steward.access"),
     ("backup.", "steward.backup"),