Phase 3: dashboards and alerting

Saved, shareable multi-panel dashboards (table/line/bar/single-stat
panels via gridstack + uPlot, global + per-panel time range, JSON
export/import) and threshold/absence alert rules with an
ok/pending/firing evaluator and webhook/Slack/PagerDuty delivery.

- New /metadata component: Postgres control-plane store for dashboards,
  panels, notification targets, alert rules/state, and delivery log --
  see docs/phase-3-dashboard-design.md for why ClickHouse's MergeTree
  family isn't a fit for this access pattern (needs real row-level
  locking and read-your-writes consistency).
- api/internal/dashboards: dashboard/panel CRUD, pure -- panel query
  execution stays client-side, reusing the existing /query endpoint.
- New /alerting service: rule/target CRUD, a ticker-driven evaluator
  (claim-then-evaluate concurrency control, transactional-outbox
  delivery, query errors and threshold zero-rows never coerced into a
  false transition) and webhook/Slack/PagerDuty delivery with
  retry/backoff. See docs/phase-3-alerting-design.md for the full
  state-machine design and the four correctness properties it
  implements.
- web: /dashboards and /alerts UIs; cli: sentryctl dashboards/alerts
  list/get/apply, seeding a future Terraform provider's JSON contract.
- hack/alert-load-test: 500 rules against real ClickHouse data, real
  measured results in docs/phase-3-runbook.md.

Five real bugs found by actually running this against a live stack
(documented in the runbook, not just fixed silently): a latent Phase 2
bug where ClickHouse rejected the timestamp format used for
earliest=/latest= queries; a "now" literal token injected into query
text; a GridStack/uPlot layout-timing race; JS's Date.parse being too
lenient to use as a timestamp-detection heuristic; a rule's "enabled"
field silently defaulting to false when omitted; and the evaluator's
claim-batch-size and worker-pool-concurrency defaulting to the same
value, causing 500 concurrently-due rules to take 125s to cycle through
instead of the configured 60s.

web/package-lock.json

@@ -7,6 +7,10 @@
 		"": {
 			"name": "web",
 			"version": "0.0.1",
+			"dependencies": {
+				"gridstack": "^11.5.0",
+				"uplot": "^1.6.32"
+			},
 			"devDependencies": {
 				"@sveltejs/adapter-static": "^3.0.10",
 				"@sveltejs/kit": "^2.63.0",
@@ -631,6 +635,22 @@
 				"node": "^8.16.0 || ^10.6.0 || >=11.0.0"
 			}
 		},
+		"node_modules/gridstack": {
+			"version": "11.5.1",
+			"resolved": "https://registry.npmjs.org/gridstack/-/gridstack-11.5.1.tgz",
+			"integrity": "sha512-qgbH65F6TtyKyi9t6fCkrxLhiobgYR3RBjnK0AzZl+YO7hreMVlsZ1MFbkPV0+7ZhjXdvcaRSZp3UA1yAJqYBQ==",
+			"funding": [
+				{
+					"type": "paypal",
+					"url": "https://www.paypal.me/alaind831"
+				},
+				{
+					"type": "venmo",
+					"url": "https://www.venmo.com/adumesny"
+				}
+			],
+			"license": "MIT"
+		},
 		"node_modules/is-reference": {
 			"version": "3.0.3",
 			"resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
@@ -1229,6 +1249,12 @@
 				"node": ">=14.17"
 			}
 		},
+		"node_modules/uplot": {
+			"version": "1.6.32",
+			"resolved": "https://registry.npmjs.org/uplot/-/uplot-1.6.32.tgz",
+			"integrity": "sha512-KIMVnG68zvu5XXUbC4LQEPnhwOxBuLyW1AHtpm6IKTXImkbLgkMy+jabjLgSLMasNuGGzQm/ep3tOkyTxpiQIw==",
+			"license": "MIT"
+		},
 		"node_modules/vite": {
 			"version": "8.2.1",
 			"resolved": "https://registry.npmjs.org/vite/-/vite-8.2.1.tgz",