Feature/93 feature rate of change alerts

[Polliog]

This pull request introduces a major new feature for the alerting system: rate-of-change (anomaly detection) alerts, along with supporting database, API, backend, and email template changes. It also adds a new backend service for calculating log volume baselines and updates validation and data types to support these features.

Key changes:

Rate-of-Change Alerts (Anomaly Detection)

• Introduced a new alert type, "rate-of-change", which triggers when current log volume deviates from a computed historical baseline by a configurable multiplier. Four baseline methods are supported: same_time_yesterday, same_day_last_week, rolling_7d_avg, and percentile_p95, with anti-spam and smart default settings. The frontend, webhook payloads, and email notifications are updated to support this new alert type.

Database Schema and Types

• Added new columns to the alert_rules table (e.g., alert_type, baseline_type, deviation_multiplier, etc.) and a baseline_metadata column to alert_history for storing anomaly context. New indexes were created to optimize queries for baseline calculations. Corresponding TypeScript types were updated to model these changes. [1] [2] [3] [4]

Backend Baseline Calculation Service

• Implemented BaselineCalculatorService in baseline-calculator.ts to compute historical baselines using various methods, leveraging the logs_hourly_stats aggregate for efficient queries. This service is exported for use throughout the alerting module. [1] [2]

API and Validation Updates

• Extended alert rule creation and update endpoints to support the new fields, with Zod validation enforcing required fields and value ranges for rate-of-change alerts. API schemas and request handlers were updated to process and store the new alert configuration options. [1] [2] [3] [4] [5]

Email Notification Enhancements

• Enhanced alert email templates to include anomaly/baseline metadata when a rate-of-change alert is triggered, providing clear context on the deviation, baseline method, and current vs. baseline rates.

These changes collectively enable powerful new anomaly detection capabilities for log alerting, with robust backend support, user-facing configuration, and clear notification channels.

refs: #93