fix(alerts): acknowledgements hold until resolve; clear after N OK; rule changes reset (#5059)

#5059 "Alert state machine: acknowledgement holds until resolve; N
consecutive OK to resolve; editing, disabling or deleting a rule resets it".

- The state machine is now next_step(), a pure function of one sample. An
  acknowledged alert stays acknowledged while breached; before, the next
  breaching sample re-fired it. Firing and acknowledged alerts resolve after
  consecutive_ok_required OK checks in a row (new rule column, default 1;
  rule form, rules list and MCP create/update_alert_rule clear_after_checks).
- Changing what a rule watches (source, resource, metric, operator,
  threshold) or disabling it resets its alert to inactive; a firing or
  acknowledged one records a resolved event whose new note says why, and
  nobody is notified. Web and MCP edits share alerts.service.apply_rule_change.
- Migration 0028: consecutive_ok_required, consecutive_ok_count,
  alert_events.note, and metric_value nullable (a reset has no sample).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/migrations/versions/0028_alert_resolve_and_reset.py

@@ -0,0 +1,31 @@
+"""Alerts resolve after N OK checks; rule changes reset state with a note
+
+Revision ID: 0028_alert_resolve_and_reset
+Revises: 0027_user_auth_source
+Create Date: 2026-10-06
+"""
+from typing import Sequence, Union
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "0028_alert_resolve_and_reset"
+down_revision: Union[str, None] = "0027_user_auth_source"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("alert_rules", sa.Column("consecutive_ok_required", sa.Integer,
+                                           nullable=False, server_default="1"))
+    op.add_column("alert_states", sa.Column("consecutive_ok_count", sa.Integer,
+                                            nullable=False, server_default="0"))
+    op.alter_column("alert_events", "metric_value", existing_type=sa.Float, nullable=True)
+    op.add_column("alert_events", sa.Column("note", sa.Text, nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("alert_events", "note")
+    op.execute("UPDATE alert_events SET metric_value = 0 WHERE metric_value IS NULL")
+    op.alter_column("alert_events", "metric_value", existing_type=sa.Float, nullable=False)
+    op.drop_column("alert_states", "consecutive_ok_count")
+    op.drop_column("alert_rules", "consecutive_ok_required")