feat(syslog): pattern alerts: telling phrases counted per source each minute for alert rules, storage-trouble presets (#6001)

A pattern (phrases, a severity, a source, a window) is counted every minute
into plugin_metrics as lines_matching_<key> per added source, zero included,
so an ordinary alert rule fires on a match and clears once the window passes.
Each count reads only the lines stored since the last, by line id; a new or
changed pattern reads its window once.

Patterns page with ready-made storage-trouble presets and "Alert on it",
which opens the rule form aimed at the count. Source names are kept unique,
and a rename moves its counts and the rules on them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/syslog/__init__.py

@@ -11,7 +11,7 @@ _app: "Quart | None" = None
 def setup(app: "Quart") -> None:
     global _app
     _app = app
-    from .models import SyslogLine, SyslogSource  # noqa: F401 — registers the tables
+    from .models import SyslogLine, SyslogPattern, SyslogSource  # noqa: F401 — registers the tables
     from .receiver import close
 
     # The listener is bound by the receive task, so it follows the settings
@@ -20,9 +20,10 @@ def setup(app: "Quart") -> None:
 
 
 def get_scheduled_tasks() -> list:
+    from .patterns import make_count_task
     from .receiver import make_receive_task
     from .retention import make_prune_task
-    return [make_receive_task(_app), make_prune_task(_app)]
+    return [make_receive_task(_app), make_prune_task(_app), make_count_task(_app)]
 
 
 def get_blueprint():
@@ -39,7 +40,14 @@ def register_mcp_tools(register) -> None:
     register_tools(register)
 
 
+def get_alert_metrics() -> dict[str, list[str]]:
+    """A pattern's count is named for the pattern (lines_matching_<key>), so
+    the list is empty here and the rule form offers the counts recorded so far."""
+    return {"syslog": []}
+
+
 def get_audit_entities() -> dict:
-    """Audit rows about a source name it and link to the Syslog page."""
-    from .models import SyslogSource
-    return {"syslog_source": (SyslogSource, "/plugins/syslog/sources/{}")}
+    """Audit rows about a source or a pattern name it and link to its page."""
+    from .models import SyslogPattern, SyslogSource
+    return {"syslog_source": (SyslogSource, "/plugins/syslog/sources/{}"),
+            "syslog_pattern": (SyslogPattern, "/plugins/syslog/patterns/{}/edit")}