feat(alerts): one evaluation path; host-agent ingest fires rules (#5060)

#5060 "One evaluation path: record_metrics batch API; host-agent ingest
evaluates rules".

- record_metrics(session, rows) writes metric rows and evaluates the rules
  that watch them, reading rules, states and maintenance windows once per
  batch. Each rule sees its key's samples oldest first, so an agent catching
  up after an outage counts consecutive checks as they happened.
- Host-agent ingest now goes through it. Before, it wrote plugin_metrics
  directly and no host_agent rule could ever fire. The catalog gains the
  per-mount disk_used_pct ("<host>:<mount>").
- MetricBatch gathers a transaction's samples; the docker ingest, traefik,
  unifi, snmp, monitor and self-monitor writers record one batch each instead
  of a rule query per sample.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/core/test_self_monitor.py

@@ -3,7 +3,7 @@
 Exercises the fd accounting, the percentage/warning floor, and that the
 recorder degrades to a no-op where fd accounting isn't available. The DB session
 and the alert pipeline are faked — we only assert that the right metrics get
-handed to record_metric.
+handed to record_metrics.
 """
 import asyncio
 import logging
@@ -48,10 +48,10 @@ class _FakeApp:
 def _patch_recorder(monkeypatch):
     recorded: list[tuple] = []
 
-    async def fake_record_metric(session, source_module, resource_name, metric_name, value):
-        recorded.append((source_module, resource_name, metric_name, value))
+    async def fake_record_metrics(session, rows):
+        recorded.extend((r.source_module, r.resource_name, r.metric_name, r.value) for r in rows)
 
-    monkeypatch.setattr(alerts, "record_metric", fake_record_metric)
+    monkeypatch.setattr(alerts, "record_metrics", fake_record_metrics)
     return recorded