feat(ui): audit, alert rules and the rule form say things in words (#5212)

#5212 "Plain labels: no raw ids, scopes, metric keys or unexplained jargon",
batch 1:

- Audit log: each action reads as a sentence ("paused monitor"), with the
  code as its tooltip. Detail shows flags as yes/no, lists joined, a run's
  scope by name, spans as spans, and no ids the entity column already gives.
  The filter is now a picker of areas.
- Alert rules, history and Status say the condition in words: "is down",
  "Fullest disk >= 85%". Readings use metric_value, and history times use
  |ago.
- Rule form: sources and metrics by name, the threshold's unit, "fires
  when it is down/up" for an up/down metric instead of 0.5, and a metric
  reference built from the catalog.
- Schedules and Maintenance: viewers no longer see Run now, Pause, Edit,
  Delete or New. Intervals and next runs read as "every 2h" and "in 3h";
  a scope reads "Every alert on Host agent".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/audit/_rows.html

@@ -3,11 +3,10 @@
 {% from "_macros.html" import scroll_more, scroll_end %}
       {% for item in events %}
       {% set e = item.event %}
-      {% set d = item.detail %}
       <tr>
         <td style="white-space:nowrap;" title="{{ e.timestamp.strftime('%Y-%m-%d %H:%M:%S UTC') }}">{{ e.timestamp|ago }}</td>
         <td style="font-size:0.85rem;">{{ e.username }}</td>
-        <td><span class="mono">{{ e.action }}</span></td>
+        <td title="{{ e.action }}">{{ item.action or e.action }}</td>
         <td>
           {% if item.entity %}
           <span class="field-hint">{{ e.entity_type|replace('_', ' ') }}</span>
@@ -16,13 +15,11 @@
           {% elif e.entity_type %}<span class="field-hint">{{ e.entity_type|replace('_', ' ') }}</span>{% endif %}
         </td>
         <td style="font-size:0.8rem;color:var(--text-muted);max-width:340px;">
-          {% if d %}
-          {% for k, v in d.items() %}
-          <span style="color:var(--text-dim);">{{ k }}:</span>
-          <span class="mono">{{ v }}</span>
+          {% for f in item.facts %}
+          <span style="color:var(--text-dim);">{{ f.label }}</span>
+          {% if f.url %}<a href="{{ f.url }}">{{ f.text }}</a>{% else %}{{ f.text }}{% endif %}
           {% if not loop.last %} &nbsp;·&nbsp; {% endif %}
           {% endfor %}
-          {% endif %}
         </td>
       </tr>
       {% endfor %}

steward/templates/audit/list.html

@@ -4,13 +4,13 @@
 {% block content %}
 {% call page_header("Audit log", "Who changed what, newest first.") %}
   <form method="get" style="display:flex;gap:0.5rem;align-items:center;">
-    <input type="text" name="action" value="{{ action_filter }}"
-           placeholder="Filter by action…" aria-label="Filter by action"
-           style="width:200px;font-size:0.85rem;">
-    <button type="submit" class="btn btn-ghost btn-sm">Filter</button>
-    {% if action_filter %}
-    <a href="/audit/" class="btn btn-ghost btn-sm">Clear</a>
-    {% endif %}
+    <select name="action" aria-label="Show only" style="font-size:0.85rem;" onchange="this.form.submit()">
+      <option value="">Everything</option>
+      {% for prefix, label in areas %}
+      <option value="{{ prefix }}" {% if action_filter == prefix %}selected{% endif %}>{{ label }}</option>
+      {% endfor %}
+    </select>
+    <noscript><button type="submit" class="btn btn-ghost btn-sm">Filter</button></noscript>
   </form>
 {% endcall %}
 
@@ -21,8 +21,8 @@
       <tr>
         <th>When</th>
         <th>User</th>
-        <th>Action</th>
-        <th>Entity</th>
+        <th>Did</th>
+        <th>What</th>
         <th>Detail</th>
       </tr>
     </thead>