feat(alerts): metric-threshold alerting (backend + API)

Operators can define metric-threshold alert rules (cpu_percent,
memory_percent, memory_bytes; gt/lt) per-workload or global via
/api/metric-alert-rules. A periodic evaluator (internal/metricalert,
30s tick) checks the freshest container stats sample per container
against enabled rules and, on breach (per-rule-per-workload cooldown),
emits into the existing event_log + bus pipeline (source "metric_alert",
workload_id set). Alerts therefore surface on the global events page,
the per-app activity timeline, and any configured event-trigger webhook
-- no new notification plumbing.

Mirrors the log_scan_rules store/API/route patterns and the
stats.Collector lifecycle. Rule CRUD reads are authed, mutations
AdminOnly. Frontend rule-config UI is a follow-up phase.

Reviewed: go APPROVE (0 CRITICAL/HIGH).

web/src/lib/i18n/en.json

@@ -551,6 +551,7 @@
       "static_site": "Static Site",
       "stale_scanner": "Stale Scanner",
       "stale_cleanup": "Stale Cleanup",
+      "metric_alert": "Metric Alert",
       "admin": "Admin"
     },
     "metadata": "Details"

web/src/lib/i18n/ru.json

@@ -551,6 +551,7 @@
       "static_site": "Статический сайт",
       "stale_scanner": "Сканер устаревших",
       "stale_cleanup": "Очистка устаревших",
+      "metric_alert": "Метрика",
       "admin": "Администратор"
     },
     "metadata": "Подробности"