Add alert rules with FilterBar-based triggers and ntfy delivery (tickets 017-019)

Adds AlertRule/AlertCondition/AlertSink models with CRUD persisted on
Settings (mirroring CssEntry's shape), per-line trigger evaluation hooked
into the engine's ingest path (Immediate/Threshold/NewValue/Ratio
conditions), and best-effort ntfy delivery spawned off the ingest hot path.

Design notes:
- Alert queries reuse FilterBar syntax but only support the
  regex()/sequence/timestamp subset (no metric[param] comparisons), since
  resolving those would require a full bucket rescan per alert per ingested
  line rather than cost proportional to new logs.
- Ratio's zero-denominator case skips evaluation for that line rather than
  treating the ratio as infinite.
- NewValue's seen-value set is in-memory only and does not survive a
  restart, matching the engine's other non-persisted runtime state.

engine::run now takes a SettingsHandle (moved from api.rs to settings.rs so
engine.rs can depend on it without a circular import) to read the current
alert rules on each ingest.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o

src/filter_parser.rs

@@ -26,6 +26,7 @@
 use pest::Parser;
 use pest::iterators::Pair;
 use pest_derive::Parser as PestParser;
+use serde::{Deserialize, Serialize};
 
 #[derive(PestParser)]
 #[grammar = "filter_parser.pest"]
@@ -47,8 +48,11 @@ pub enum FilterExpr {
     Or(Box<FilterExpr>, Box<FilterExpr>),
 }
 
-/// Comparison operators supported by metric comparisons.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+/// Comparison operators supported by metric comparisons. Also reused by
+/// `crate::alerts::AlertCondition::Threshold`/`Ratio` for their own
+/// threshold/ratio comparisons (hence `Serialize`/`Deserialize`).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
 pub enum CompareOp {
     Lt,
     Gt,