feat(timeline): one record of what happened to the infrastructure, newest first (#6348)

A stored log, timeline_entries, with one row per thing that happened. Each
source writes its row in the same transaction as its own record, so the
history outlives the 30/90/365-day retention of the tables it points to:

- alert events (core/alerts._add_event): fired, resolved, acknowledged,
  went silent, readings back;
- finished Ansible runs (executor, and the startup sweep of interrupted
  runs): changed something, changed nothing, failed, dry run;
- audit rows (core/audit.log_audit): Steward's settings, users and access,
  sign-ins, backups. Actions another writer records are left to it.

Entries carry a kind (fixed) and an area (Service, Host OS, Hardware,
Storage, Network, Security, Monitoring). Settings → Timeline edits the
areas and each type's area and visibility; both are applied when the
timeline is read, so a change re-sorts past entries and a hidden type
comes back when shown. Kept forever unless a retention is set.

The first start fills the timeline from the last 90 days of records once,
skipping any already covered. A host rename carries its entries.

UI: Timeline in the sidebar (filter by host, area, kind; scrolls on), a
History card on each host page. MCP: get_timeline.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/core/test_alert_no_data.py

@@ -113,7 +113,8 @@ def test_a_sample_after_silence_clears_it_and_says_so():
     assert note == "data resumed after 15m silent"
 
 
-_RULE = NS(id="r", operator=AlertOperator.gt, threshold=90.0,
+_RULE = NS(id="r", name="Slow database", source_module="steward", resource_name="steward",
+           metric_name="db_roundtrip_ms", operator=AlertOperator.gt, threshold=90.0,
            consecutive_failures_required=1, consecutive_ok_required=1)
 
 
@@ -132,8 +133,12 @@ def test_a_resumed_series_gets_one_event_for_what_its_first_sample_did(
     session, st = _Session(), _state(state=before)
     said = "data resumed after 15m silent"
     out = asyncio.run(_evaluate_rule(session, _RULE, st, value, NOW, resumed=said))
-    [event] = session.added
+    event, entry = session.added            # the alert's event, then its timeline entry
     assert (event.from_state, event.to_state) == want_event
+    assert (entry.ref_type, entry.ref_id, entry.at) == ("alert_event", event.id, NOW)
+    # A firing alert still firing when its series returns is a resume, not a new firing.
+    assert entry.type == {"firing": "alert.fired", "resolved": "alert.resolved",
+                          "data_resumed": "alert.resumed"}[want_notice]
     assert event.note == said and event.transitioned_at == NOW
     assert [(n, e) for n, e, _ in out] == [(want_notice, event.id)]
     # Without a resume, a sample that changes nothing records nothing.