feat(alerts): an acknowledgement is on the record, with who made it (#5463)

#5463 "Acknowledgements on record: an event and who did it", step 1 of
milestone 499 "Alerts you can trust". The live walk in #5461 found that
acknowledging changed only the alert's current state: once it resolved,
nothing said who had acknowledged it or when.

- alert_events.actor_id (migration 0040): the person behind a transition.
- Acknowledging writes a firing → acknowledged event by the acknowledger.
- A rule edit, disable or enable that resets an alert carries its actor
  (web and MCP alike).
- The history page notes "acknowledged by X" and "rule disabled by X"; MCP
  get_alert_history returns `by`.
- One usernames() helper in alerts.service, used by the active list, the
  history page and the MCP tools.
- docs/core/alerting.md: the state diagram no longer shows an acknowledged
  alert re-firing, and says what an event records.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/mcp/tools/alerts.py

@@ -8,7 +8,7 @@ from sqlalchemy import select
 from steward.alerts import service as alert_svc
 from steward.mcp._context import current_caller
 from steward.models.alerts import AlertOperator, AlertRule, AlertState, MaintenanceWindow
-from steward.models.users import User, UserRole
+from steward.models.users import UserRole
 
 from ._audit import audit_mcp
 from ._shape import (
@@ -33,13 +33,6 @@ def _action(rule: AlertRule) -> dict | None:
                                   "extra_vars", "check") if a.get(k) is not None}
 
 
-async def _usernames(db, ids) -> dict[str, str]:
-    ids = {i for i in ids if i}
-    if not ids:
-        return {}
-    return dict((await db.execute(select(User.id, User.username).where(User.id.in_(ids)))).all())
-
-
 async def list_alerts() -> dict:
     """Alerts that need attention now: firing, pending, acknowledged but still
     breaching, or gone silent (no_data).
@@ -56,7 +49,7 @@ async def list_alerts() -> dict:
     """
     async with db_session() as db:
         active = await alert_svc.active_alerts(db)
-        names = await _usernames(db, [s.acknowledged_by for s, _ in active])
+        names = await alert_svc.usernames(db, (s.acknowledged_by for s, _ in active))
     order = {"firing": 0, "no_data": 1, "pending": 2, "acknowledged": 3}
     rows = [
         {
@@ -89,7 +82,9 @@ async def get_alert_history(rule: str = "", range: str = "7d", limit: int = 50)
 
     Each transition carries the metric value that caused it and whether the
     email/webhook notification went out (with the error if not), plus the id
-    of any Ansible run the rule's action triggered.
+    of any Ansible run the rule's action triggered. `by` names the person who
+    made it happen (an acknowledgement, or a rule edit that reset the alert);
+    null when a reading or Steward itself did.
     """
     since, key = lookback(range)
     limit = clamp_limit(limit, 50, 500)
@@ -97,6 +92,7 @@ async def get_alert_history(rule: str = "", range: str = "7d", limit: int = 50)
         rules = await alert_svc.list_rules(db)
         chosen = pick(rule, rules, kind="alert rule", list_tool="list_alert_rules") if rule else None
         rows = await alert_svc.history(db, since, chosen.id if chosen else None, limit)
+        names = await alert_svc.usernames(db, (e.actor_id for e, _ in rows))
     events = [
         {
             "rule_id": r.id,
@@ -105,6 +101,7 @@ async def get_alert_history(rule: str = "", range: str = "7d", limit: int = 50)
             "to_state": e.to_state,
             "metric_value": rnd(e.metric_value),
             "note": e.note,
+            "by": names.get(e.actor_id, e.actor_id),
             "at": iso(e.transitioned_at),
             "age_s": age_s(e.transitioned_at),
             "email_sent": e.email_sent,
@@ -296,7 +293,8 @@ async def update_alert_rule(rule: str, name: str | None = None, source_module: s
             consecutive_ok_required=(r.consecutive_ok_required
                                      if clear_after_checks is None else clear_after_checks),
             notify_no_data=r.notify_no_data if notify_no_data is None else notify_no_data)
-        await alert_svc.apply_rule_change(db, r, fields, enabled=enabled)
+        await alert_svc.apply_rule_change(db, r, fields, enabled=enabled,
+                                          actor_id=current_caller().user_id)
     changed = sorted(k for k, v in {"name": name, "source_module": source_module,
                                     "resource": resource, "metric": metric, "operator": operator,
                                     "threshold": threshold, "consecutive_checks": consecutive_checks,