[add] MCP tools for the alerting engine

[malickyeu]

Summary

MCP knew nothing about alerting. Three tools close that:

• list_alerts — the history, with the same filters the UI has (severity,
  lifecycle kind, container, rule, message text).
• active_alert_conditions — what is over threshold right now, and for how
  long each has been going.
• acknowledge_alert — record that a human has seen one.

The first two are separate on purpose. Now that an alert is a condition with a
lifetime rather than a line reprinted every cycle, "what happened" and "what is
wrong now" are different questions. An assistant that asks the first when it
meant the second will confidently report a problem that resolved an hour ago, so
the tool descriptions say which is which and point diagnosis at the live one.

Type of change

• Bug fix
• New feature
• Docs only
• Refactor / chore

Checklist

• go test -short ./... and go vet ./... pass
• gofmt gate is clean (gofmt -l $(git ls-files '*.go') after staging)
• Frontend type-checks — N/A (no UI changed)
• Rebuilt and committed web/dist — N/A
• Added/updated tests for the change
• Updated docs/ and added a CHANGELOG.md entry

Notes for reviewers

The security shape here is one the existing systemic tests could not catch.
TestEveryToolConsultsTheAccessGate and TestEveryToolRespectsTokenScope call
each tool with an explicit host_id. list_alerts is an aggregate: called with
no host argument, the gate is consulted once, passes (the local daemon is always
in reach), and the result set would span every host. So host scoping goes into
the query via AlertQuery.HostIDs, the same way the REST feed does it, and this
PR adds its own pentests.

Two things the tests found, both worth stating:

1. scopedHostIDs missed admins. They bypass roles, so they have no grants,
   and ReachableHosts reports "no hosts" for them — which would have hidden every
   remote host's alerts from the one principal allowed to see all of them. The REST
   side checks IsAdmin() before ReachableHosts for exactly this reason; I had
   not. Caught because a test failed for a reason I first assumed was the test's
   fault — it was half the test's fault and half a real bug.

2. The first version of the pentest was vacuous. It asserted on
   scopedHostIDs and on a store query built by the test itself, so deleting the
   scoping from listAlerts changed nothing and it still passed. It now calls the
   tool, and fails under that mutation with
   SECURITY: list_alerts returned an alert from an unreachable host. That is the
   fifth vacuous test caught by mutation testing in this line of work — the pattern
   is always the same: the test restates the logic instead of exercising the caller.

acknowledge_alert is a write even though it changes nothing about a
container. Acknowledging is an attributed claim that somebody looked, so a
read-only user or token is refused, and it is audited as mcp.alert.ack.

Not included: anything that would widen the MCP surface — no rule editing, no
silencing. Both are roadmap items and both deserve their own decision.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.