Catch silent failures that slipped past existing alerts

[scotwells]

Summary

Adds five new alerts to cover failure modes discovered during a production validation that went undetected by existing alerting.

New alerts

• NATS consumer lag — fires when audit event backlog exceeds 5,000 messages for 5+ minutes
• Audit query timeouts — catches 504 errors on audit log queries at a sustained rate
• ClickHouse iteration errors — surfaces row streaming failures during query execution
• Vector write pipeline stopped — detects when Vector receives events from NATS but stops writing to ClickHouse
• DLQ slow leak — catches low-rate persistent failures that fall below the existing fast-growth alert

What prompted this

Post-deploy validation found a 48-hour gap where Vector stopped writing events to ClickHouse with no alert, a 10-hour NATS consumer stall with no alert, and ongoing DLQ accumulation from a broken policy with no alert.

Test plan

• Deploy to staging and verify all new alerts evaluate without errors
• Confirm alerts are inactive during normal healthy operation
• Verify VectorClickHouseWritesStopped correctly uses component_type selector

Closes #144

🤖 Generated with Claude Code