feat(syslog): pattern alerts: telling phrases counted per source each minute for alert rules, storage-trouble presets (#6001)

A pattern (phrases, a severity, a source, a window) is counted every minute
into plugin_metrics as lines_matching_<key> per added source, zero included,
so an ordinary alert rule fires on a match and clears once the window passes.
Each count reads only the lines stored since the last, by line id; a new or
changed pattern reads its window once.

Patterns page with ready-made storage-trouble presets and "Alert on it",
which opens the rule form aimed at the count. Source names are kept unique,
and a rename moves its counts and the rules on them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/syslog/migrations/versions/syslog_002_patterns.py

@@ -0,0 +1,35 @@
+"""Syslog: telling phrases counted per source into the metric store (#6001)
+
+Revision ID: syslog_002_patterns
+Revises: syslog_001_sources_lines
+Create Date: 2026-10-19
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "syslog_002_patterns"
+down_revision: Union[str, None] = "syslog_001_sources_lines"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "syslog_patterns",
+        sa.Column("id", sa.String(36), primary_key=True),
+        sa.Column("key", sa.String(48), nullable=False, unique=True),
+        sa.Column("name", sa.String(100), nullable=False),
+        sa.Column("phrases", sa.JSON, nullable=False),
+        sa.Column("max_severity", sa.SmallInteger, nullable=True),
+        sa.Column("source_id", sa.String(36),
+                  sa.ForeignKey("syslog_sources.id", ondelete="CASCADE"), nullable=True),
+        sa.Column("window_minutes", sa.SmallInteger, nullable=False, server_default="15"),
+        sa.Column("enabled", sa.Boolean, nullable=False, server_default=sa.true()),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("syslog_patterns")