feat(ui): audit, alert rules and the rule form say things in words (#5212)

#5212 "Plain labels: no raw ids, scopes, metric keys or unexplained jargon",
batch 1:

- Audit log: each action reads as a sentence ("paused monitor"), with the
  code as its tooltip. Detail shows flags as yes/no, lists joined, a run's
  scope by name, spans as spans, and no ids the entity column already gives.
  The filter is now a picker of areas.
- Alert rules, history and Status say the condition in words: "is down",
  "Fullest disk >= 85%". Readings use metric_value, and history times use
  |ago.
- Rule form: sources and metrics by name, the threshold's unit, "fires
  when it is down/up" for an up/down metric instead of 0.5, and a metric
  reference built from the catalog.
- Schedules and Maintenance: viewers no longer see Run now, Pause, Edit,
  Delete or New. Intervals and next runs read as "every 2h" and "in 3h";
  a scope reads "Every alert on Host agent".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/alerts/maintenance.html

@@ -3,8 +3,9 @@
 {% block title %}Maintenance Windows — Steward{% endblock %}
 {% block breadcrumb %}{{ crumbs([("Alerts", "/alerts/"), ("Maintenance", "")]) }}{% endblock %}
 {% block content %}
+{% set can_edit = session.user_role in ('operator', 'admin') %}
 {% call page_header("Maintenance windows", "During an active window, alerts in its scope still change state and show on the Alerts page, but send no notifications and run no Ansible actions. Each event a window mutes says so in the alert's history. An alert that is still firing when the window ends notifies then, and runs its action.") %}
-    <a class="btn" href="/alerts/maintenance/new">New window</a>
+    {% if can_edit %}<a class="btn" href="/alerts/maintenance/new">New window</a>{% endif %}
 {% endcall %}
 
 {% macro window_table(rows, kind) %}
@@ -28,9 +29,9 @@
           {% if w.scope_source is none %}
             <span title="All alert rules">All alerts</span>
           {% elif w.scope_resource is none %}
-            <span>{{ w.scope_source }}/*</span>
+            <span>Every alert on {{ source_label(w.scope_source) }}</span>
           {% else %}
-            <span>{{ w.scope_source }}/{{ w.scope_resource }}</span>
+            <span>{{ w.scope_resource }}</span> <span class="field-hint">{{ source_label(w.scope_source) }}</span>
           {% endif %}
         </td>
         <td style="font-size:0.85rem;font-family:ui-monospace,monospace;">
@@ -45,10 +46,12 @@
           {% else %}{{ status_badge('inactive', 'Expired') }}<div class="field-hint">ended {{ w.end_at|ago }}</div>{% endif %}
         </td>
         <td class="td-actions">
+          {% if session.user_role in ('operator', 'admin') %}
           <form method="post" action="/alerts/maintenance/{{ w.id }}/delete" style="display:inline;">{{ csrf_field() }}
             <button type="submit" class="btn btn-sm btn-danger"
                     data-confirm="Delete window &quot;{{ w.name }}&quot;?">Delete</button>
           </form>
+          {% endif %}
         </td>
       </tr>
       {% endfor %}
@@ -76,6 +79,6 @@
 </details>
 {% endif %}
 {% else %}
-<div class="card">{{ empty_state("No maintenance windows yet.", "New window", "/alerts/maintenance/new") }}</div>
+<div class="card">{% if can_edit %}{{ empty_state("No maintenance windows yet.", "New window", "/alerts/maintenance/new") }}{% else %}{{ empty_state("No maintenance windows yet.") }}{% endif %}</div>
 {% endif %}
 {% endblock %}