Stage 3: Alertmanager webhook ingestion and alert query API

- Migration 003: alerts table with fingerprint UNIQUE, JSON label/annotation
  columns, nullable ends_at, and indexed status/name/received_at
- POST /api/alertmanager/webhook — upserts each alert by fingerprint;
  zero endsAt ("0001-01-01") stored as NULL (still firing)
- GET /api/alerts — filtered list (?status, ?name, ?from, ?to, ?limit)
- GET /api/alerts/{id} — single alert lookup

internal/api/router.go

@@ -17,8 +17,9 @@ func NewRouter(db *sql.DB) http.Handler {
 		respond(w, http.StatusOK, map[string]string{"status": "ok"})
 	})
 
-	// Unauthenticated: bootstrap (only works when user table is empty).
+	// Unauthenticated: bootstrap and Alertmanager webhook receiver.
 	r.Post("/api/bootstrap", handleBootstrap(db))
+	r.Post("/api/alertmanager/webhook", handleAlertmanagerWebhook(db))
 
 	// All other /api routes require a valid API key.
 	r.Group(func(r chi.Router) {
@@ -29,6 +30,9 @@ func NewRouter(db *sql.DB) http.Handler {
 		r.Delete("/api/users/{id}", handleDeleteUser(db))
 		r.Post("/api/users/{id}/api-keys", handleCreateAPIKey(db))
 		r.Delete("/api/users/{id}/api-keys/{keyID}", handleDeleteAPIKey(db))
+
+		r.Get("/api/alerts", handleListAlerts(db))
+		r.Get("/api/alerts/{id}", handleGetAlert(db))
 	})
 
 	return r