Add alert rules with FilterBar-based triggers and ntfy delivery (tickets 017-019)

Adds AlertRule/AlertCondition/AlertSink models with CRUD persisted on
Settings (mirroring CssEntry's shape), per-line trigger evaluation hooked
into the engine's ingest path (Immediate/Threshold/NewValue/Ratio
conditions), and best-effort ntfy delivery spawned off the ingest hot path.

Design notes:
- Alert queries reuse FilterBar syntax but only support the
  regex()/sequence/timestamp subset (no metric[param] comparisons), since
  resolving those would require a full bucket rescan per alert per ingested
  line rather than cost proportional to new logs.
- Ratio's zero-denominator case skips evaluation for that line rather than
  treating the ratio as infinite.
- NewValue's seen-value set is in-memory only and does not survive a
  restart, matching the engine's other non-persisted runtime state.

engine::run now takes a SettingsHandle (moved from api.rs to settings.rs so
engine.rs can depend on it without a circular import) to read the current
alert rules on each ingest.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o

src/main.rs

@@ -1,3 +1,4 @@
+mod alerts;
 mod api;
 mod data_value;
 mod dto;
@@ -53,7 +54,7 @@ async fn main() {
     let settings = Arc::new(Mutex::new(Settings::load(&settings_path)));
 
     let (engine_tx, engine_rx) = mpsc::channel(1024);
-    tokio::spawn(engine::run(engine_rx));
+    tokio::spawn(engine::run(engine_rx, settings.clone()));
     {
         let max_logs = settings.lock().unwrap().max_logs;
         let _ = engine_tx.send(engine::EngineMessage::SetMaxLogs(max_logs)).await;