Give each team its own dead man's switches, and the UI a team to show

The rest of #4. Two halves that belong together because they are the
same sentence from opposite ends: a team decides which of its alerts are
heartbeats, and the UI has to be able to say which team it is talking
about.

Switches were three environment variables, which made them one setting
for the whole install. That was the last piece of the alerting path a
team could not control: it could take its own alerts on its own key and
still not say which of them were heartbeats, or how long a silence had
to last. They are a row per team now, edited by an owner through
PUT /api/teams/{teamID}/deadman, and the sweeper runs each team against
its own matchers, timeout and severity.

The environment variables become the starting point rather than the
setting. Every team without a configuration is seeded from them at
startup, so an upgrade keeps watching exactly what it was watching, and
SeedDeadmanConfigs never overwrites -- a redeploy must not put the
environment's value back over an owner's edit. A team created later
watches nothing until somebody says otherwise: inheriting an
install-wide heartbeat would page a new team about a source it has never
heard of, and a switch nobody chose is the kind that gets muted rather
than fixed.

A matcher string with no alertname in it is refused at the door instead
of stored. Storing it would produce a switch that watches nothing
silently, which is the exact failure the feature exists to prevent.

NewRouter and Sweep lose their DeadmanConfig parameter -- there is no
longer one answer to hand them. The type stays, because parsing a
matcher string is still parsing a matcher string.

The UI side: rows in the queue carry a team badge, the filter row gains
a team chip per team, and "on call now" shows one card per team. All
three appear only when the viewer is in more than one team -- otherwise
they are the same word repeated down a list, which is noise rather than
information, and the single-team install reads exactly as it did before
teams existed.

Verified against a live two-team server as well as in tests: the
combined queue labelled by team, the team_id filter, a heartbeat that is
a heartbeat in one team and an ordinary alert in another, and a new
team's switches starting empty while the upgraded team keeps the
environment's.

Claude-Session: https://claude.ai/code/session_01RHPj4ggeFdEjKKfm4SHbD7

internal/api/teams.go

@@ -471,3 +471,105 @@ func defaultTeamID(ctx context.Context, db *sql.DB) (int64, error) {
 	err := db.QueryRowContext(ctx, "SELECT id FROM teams ORDER BY id LIMIT 1").Scan(&id)
 	return id, err
 }
+
+// ---------------------------------------------------------------------------
+// A team's dead man's switches
+// ---------------------------------------------------------------------------
+
+// deadmanResponse is the wire shape of a team's switch configuration. The
+// timeout is seconds rather than a duration string, because that is what the
+// column holds and what arithmetic is done on; a client renders it.
+type deadmanResponse struct {
+	TeamID         int64  `json:"team_id"`
+	Matchers       string `json:"matchers"`
+	TimeoutSeconds int64  `json:"timeout_seconds"`
+	Severity       string `json:"severity"`
+}
+
+func handleGetTeamDeadman(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamMember(w, r, teamID) {
+			return
+		}
+
+		out := deadmanResponse{TeamID: teamID, Severity: "critical"}
+		err := db.QueryRowContext(r.Context(),
+			"SELECT matchers, timeout_seconds, severity FROM deadman_configs WHERE team_id = $1",
+			teamID).Scan(&out.Matchers, &out.TimeoutSeconds, &out.Severity)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+		// A team with no row watches nothing, which is a configuration and not
+		// an absence: answering 404 would make "off" indistinguishable from
+		// "this server does not do this".
+		respond(w, http.StatusOK, out)
+	}
+}
+
+// handleSetTeamDeadman replaces a team's switch configuration.
+//
+// Validated by parsing: a matcher string that survives ParseDeadmanConfig with
+// nothing usable in it is rejected rather than stored, because a switch that
+// silently watches nothing is the failure this feature exists to prevent.
+func handleSetTeamDeadman(db *sql.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		teamID, ok := teamParam(w, r)
+		if !ok {
+			return
+		}
+		if !requireTeamOwner(w, r, teamID) {
+			return
+		}
+
+		var req struct {
+			Matchers       string `json:"matchers"`
+			TimeoutSeconds int64  `json:"timeout_seconds"`
+			Severity       string `json:"severity"`
+		}
+		if err := decodeJSON(r, &req); err != nil {
+			respond(w, http.StatusBadRequest, errResp("invalid request body"))
+			return
+		}
+		req.Matchers = strings.TrimSpace(req.Matchers)
+		if req.Severity == "" {
+			req.Severity = "critical"
+		}
+		if req.TimeoutSeconds < 0 {
+			respond(w, http.StatusBadRequest, errResp("timeout_seconds must not be negative"))
+			return
+		}
+		if req.Matchers != "" {
+			parsed := parseDeadmanQuietly(req.Matchers, time.Duration(req.TimeoutSeconds)*time.Second, req.Severity)
+			if len(parsed.Matchers) == 0 {
+				respond(w, http.StatusBadRequest, errResp(
+					"no usable matchers: each must name an alertname, as in alertname=Watchdog,cluster=prod"))
+				return
+			}
+		}
+
+		if _, err := db.ExecContext(r.Context(), `
+			INSERT INTO deadman_configs (team_id, matchers, timeout_seconds, severity, updated_at)
+			VALUES ($1, $2, $3, $4, `+nowEpoch+`)
+			ON CONFLICT (team_id) DO UPDATE SET
+				matchers        = excluded.matchers,
+				timeout_seconds = excluded.timeout_seconds,
+				severity        = excluded.severity,
+				updated_at      = excluded.updated_at`,
+			teamID, req.Matchers, req.TimeoutSeconds, req.Severity); err != nil {
+			respond(w, http.StatusInternalServerError, errResp("internal error"))
+			return
+		}
+
+		respond(w, http.StatusOK, deadmanResponse{
+			TeamID:         teamID,
+			Matchers:       req.Matchers,
+			TimeoutSeconds: req.TimeoutSeconds,
+			Severity:       req.Severity,
+		})
+	}
+}