feat(ui): audit, alert rules and the rule form say things in words (#5212)

#5212 "Plain labels: no raw ids, scopes, metric keys or unexplained jargon",
batch 1:

- Audit log: each action reads as a sentence ("paused monitor"), with the
  code as its tooltip. Detail shows flags as yes/no, lists joined, a run's
  scope by name, spans as spans, and no ids the entity column already gives.
  The filter is now a picker of areas.
- Alert rules, history and Status say the condition in words: "is down",
  "Fullest disk >= 85%". Readings use metric_value, and history times use
  |ago.
- Rule form: sources and metrics by name, the threshold's unit, "fires
  when it is down/up" for an up/down metric instead of 0.5, and a metric
  reference built from the catalog.
- Schedules and Maintenance: viewers no longer see Run now, Pause, Edit,
  Delete or New. Intervals and next runs read as "every 2h" and "in 3h";
  a scope reads "Every alert on Host agent".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/alerts/service.py

@@ -131,17 +131,32 @@ async def resource_url(db, rule: AlertRule) -> str | None:
 _BINARY = ("is_up", "is_healthy")
 
 
+def rule_condition(rule: AlertRule) -> str:
+    """What a rule fires on, in words: "CPU > 90%", "Fullest disk >= 85%",
+    or "is down" for an up/down metric rather than "is_up < 0.5"."""
+    from steward.core.alerts import _is_breached
+    from steward.core.formatting import metric_label, metric_value
+    metric = rule.metric_name
+    if metric in _BINARY:
+        fires_on = [metric_value(metric, v) for v in (1.0, 0.0)
+                    if _is_breached(v, rule.operator, rule.threshold)]
+        if len(fires_on) == 1:
+            return f"is {fires_on[0]}"
+    return f"{metric_label(metric)} {rule.operator.value} {metric_value(metric, rule.threshold)}"
+
+
 def alert_sentence(rule: AlertRule, label: str, value: float | None,
              since: datetime | None, now: datetime) -> dict:
     """An alert as one sentence around its resource: {"lead", "resource",
-    "tail"}, read lead + resource + tail, e.g. "cpu_pct on " + "web-1" +
+    "tail"}, read lead + resource + tail, e.g. "CPU on " + "web-1" +
     " is 94% (> 90%), firing for 12m". label is alert_label(state); since is
     when that label began (no_data_since for no_data)."""
-    from steward.core.formatting import human_duration, metric_value
+    from steward.core.formatting import human_duration, metric_label, metric_value
     metric = rule.metric_name
+    said = metric_label(metric)
     held = human_duration((now - since).total_seconds()) if since else None
     if label == "no_data":
-        return {"lead": f"No {metric} from ", "resource": rule.resource_name,
+        return {"lead": f"No {said} reading from ", "resource": rule.resource_name,
                 "tail": f" for {held}" if held else ""}
     # An acknowledged alert is still breaching: say for how long it has been,
     # not how long ago someone acknowledged it (the page says that apart).
@@ -155,7 +170,7 @@ def alert_sentence(rule: AlertRule, label: str, value: float | None,
     else:
         reading = f" is {metric_value(metric, value)}"
     condition = f" ({rule.operator.value} {metric_value(metric, rule.threshold)})"
-    return {"lead": f"{metric} on ", "resource": rule.resource_name,
+    return {"lead": f"{said} on ", "resource": rule.resource_name,
             "tail": f"{reading}{condition}{for_how_long}"}