feat(ui): audit, alert rules and the rule form say things in words (#5212)

#5212 "Plain labels: no raw ids, scopes, metric keys or unexplained jargon",
batch 1:

- Audit log: each action reads as a sentence ("paused monitor"), with the
  code as its tooltip. Detail shows flags as yes/no, lists joined, a run's
  scope by name, spans as spans, and no ids the entity column already gives.
  The filter is now a picker of areas.
- Alert rules, history and Status say the condition in words: "is down",
  "Fullest disk >= 85%". Readings use metric_value, and history times use
  |ago.
- Rule form: sources and metrics by name, the threshold's unit, "fires
  when it is down/up" for an up/down metric instead of 0.5, and a metric
  reference built from the catalog.
- Schedules and Maintenance: viewers no longer see Run now, Pause, Edit,
  Delete or New. Intervals and next runs read as "every 2h" and "in 3h";
  a scope reads "Every alert on Host agent".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/audit/list.html

@@ -4,13 +4,13 @@
 {% block content %}
 {% call page_header("Audit log", "Who changed what, newest first.") %}
   <form method="get" style="display:flex;gap:0.5rem;align-items:center;">
-    <input type="text" name="action" value="{{ action_filter }}"
-           placeholder="Filter by action…" aria-label="Filter by action"
-           style="width:200px;font-size:0.85rem;">
-    <button type="submit" class="btn btn-ghost btn-sm">Filter</button>
-    {% if action_filter %}
-    <a href="/audit/" class="btn btn-ghost btn-sm">Clear</a>
-    {% endif %}
+    <select name="action" aria-label="Show only" style="font-size:0.85rem;" onchange="this.form.submit()">
+      <option value="">Everything</option>
+      {% for prefix, label in areas %}
+      <option value="{{ prefix }}" {% if action_filter == prefix %}selected{% endif %}>{{ label }}</option>
+      {% endfor %}
+    </select>
+    <noscript><button type="submit" class="btn btn-ghost btn-sm">Filter</button></noscript>
   </form>
 {% endcall %}
 
@@ -21,8 +21,8 @@
       <tr>
         <th>When</th>
         <th>User</th>
-        <th>Action</th>
-        <th>Entity</th>
+        <th>Did</th>
+        <th>What</th>
         <th>Detail</th>
       </tr>
     </thead>