fix(alerts): acknowledgements hold until resolve; clear after N OK; rule changes reset (#5059)

#5059 "Alert state machine: acknowledgement holds until resolve; N
consecutive OK to resolve; editing, disabling or deleting a rule resets it".

- The state machine is now next_step(), a pure function of one sample. An
  acknowledged alert stays acknowledged while breached; before, the next
  breaching sample re-fired it. Firing and acknowledged alerts resolve after
  consecutive_ok_required OK checks in a row (new rule column, default 1;
  rule form, rules list and MCP create/update_alert_rule clear_after_checks).
- Changing what a rule watches (source, resource, metric, operator,
  threshold) or disabling it resets its alert to inactive; a firing or
  acknowledged one records a resolved event whose new note says why, and
  nobody is notified. Web and MCP edits share alerts.service.apply_rule_change.
- Migration 0028: consecutive_ok_required, consecutive_ok_count,
  alert_events.note, and metric_value nullable (a reset has no sample).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/alerts/rules_form.html

@@ -90,6 +90,15 @@
                value="{{ rule.consecutive_failures_required if rule else 1 }}">
       </div>
 
+      <div class="form-group">
+        <label>Consecutive OK checks before it clears</label>
+        <input type="number" name="consecutive_ok_required" min="1"
+               value="{{ rule.consecutive_ok_required if rule else 1 }}">
+        <p style="font-size:0.75rem;color:var(--text-muted);margin-top:0.2rem;">
+          A firing or acknowledged alert resolves only after this many checks in a row are back
+          within the threshold. An acknowledgement holds until then.</p>
+      </div>
+
       {# ── Metric reference ────────────────────────────────────────────────── #}
       <details style="margin-bottom:1rem;">
         <summary style="cursor:pointer;font-size:0.82rem;color:var(--text-muted);user-select:none;">