feat(syslog): pattern alerts: telling phrases counted per source each minute for alert rules, storage-trouble presets (#6001)

A pattern (phrases, a severity, a source, a window) is counted every minute
into plugin_metrics as lines_matching_<key> per added source, zero included,
so an ordinary alert rule fires on a match and clears once the window passes.
Each count reads only the lines stored since the last, by line id; a new or
changed pattern reads its window once.

Patterns page with ready-made storage-trouble presets and "Alert on it",
which opens the rule form aimed at the count. Source names are kept unique,
and a rename moves its counts and the rules on them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/audit/service.py

@@ -203,6 +203,9 @@ ACTIONS = {
     "syslog.source_removed": "removed syslog source",
     "syslog.source_ignored": "ignored syslog sender",
     "syslog.source_offered": "offered again syslog sender",
+    "syslog.pattern_added": "added syslog pattern",
+    "syslog.pattern_updated": "changed syslog pattern",
+    "syslog.pattern_removed": "removed syslog pattern",
     "backup.made": "sent a backup",
     "backup.failed": "tried to send a backup, which failed:",
     "backup.restored": "restored Steward from a backup",