feat(alerts): one rule can cover every host, or every host in a group (#5464)

#5464 "Group rules: one rule covers every host, or every host in a group",
step 2 of milestone 499 "Alerts you can trust". Each rule named one host, so
the live instance carried six rules for three hosts, and a new host had no
agent-offline or disk alert until someone copied them.

- alert_rules.covers / cover_group / parent_id (migration 0041). A rule on
  host_agent may cover "all_hosts" or a "group" (an inventory group: the
  Hosts ruling, #5294). A covering rule has no state; Steward keeps one
  ordinary child rule per covered host, named "<rule>: <host>", so each
  host's alert keeps its own state, history and acknowledgement.
- alerts.service.reconcile_children: a covered host that has reported in
  the last 7 days gets a child; a host no longer covered loses its child;
  children take the parent's condition, checks, notify setting, action and
  on/off. Run on save and each minute (alert_reconcile).
- A child is changed through its parent: edit, toggle and delete of a child
  are refused (409 / PartOfCoveringRule); its edit page opens the parent.
- Rule form: a Covers choice for host sources, with the group picker; fixed
  once the rule exists. Rules list: a covering rule reads "every host in
  swarm · 3 hosts" with its hosts' rules nested under it, each opening its
  history. The history picker and the rule count leave covering rules out.
- MCP: create_alert_rule takes covers/group; update_alert_rule takes group
  and passes changes down; list_alert_rules shows covers, hosts and part_of.
- docs/core/alerting.md: "Rules that cover hosts".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/core/alerting.md

@@ -75,6 +75,29 @@ Alert rules are created in the UI at `/alerts/`. Each rule requires:
 - **Threshold** — numeric value
 - **Consecutive failures required** — how many consecutive breaches before FIRING (default 1)
 
+### Rules that cover hosts
+
+A rule on `host_agent` can cover **every host**, or **every host in an
+inventory group**, instead of naming one resource (#5464). Inventory groups
+are Steward's grouping system: a host is in a group through its linked
+Ansible target.
+
+A covering rule has no state of its own. Steward keeps one ordinary rule per
+covered host under it, named `<rule>: <host>`, so each host's alert keeps its
+own state, history and acknowledgement. Each minute (the `alert_reconcile`
+task), and whenever the rule is saved:
+
+- a host that has reported in the last 7 days, and is covered, gets a rule;
+- a host that is no longer covered loses its rule, and that rule's history;
+- the hosts' rules take the covering rule's condition, checks, notification
+  setting, action and on/off.
+
+A host's rule is changed through its covering rule; editing, disabling or
+deleting it alone is refused. What a rule covers is fixed once it exists, but
+a group rule can move to another group. Over MCP, `create_alert_rule` takes
+`covers` ("all_hosts" or "group") and `group`, and `list_alert_rules` shows
+each covering rule's `hosts` and each host's rule's `part_of`.
+
 ### Available Metrics by Module
 
 | `source_module` | `metric_name` | Description |