Scope everything to a team, and route alerts by integration key

The core of #4, and what #1 is for: terdut stops being one shared space.
A team owns its incidents, alerts, schedule and integrations; a user sees
exactly the teams they are in. Everything that existed moves into one
Default team and every existing user becomes an owner of it, so the
upgrade is a no-op for the people using it.

Ingestion is the load-bearing half. An alert arrives on a team's
integration key, and the key is both the credential and the routing: it
says that the sender may post, and which team the alerts belong to. That
also closes the unauthenticated webhook -- the old path stays for one
release, deprecated and routed to the oldest team, so an upgrade does not
stop delivering while somebody edits the Alertmanager config.

Scoping is enforced in as few places as possible, because the failure
mode is silent. serveAs loads the caller's memberships once; list queries
carry `team_id = ANY(...)`; and every incident route goes through
incidentIDParam, which now parses the id AND checks the team in the same
call, so a new handler cannot remember the first half and forget the
second. Anything in another team is 404, never 403: whether an incident
exists is that team's business.

Two bugs this found, both of which would have been silent:

  * upsertAlerts decided "is this a new occurrence" by looking up the
    fingerprint alone. Across teams that made team B's first alert look
    like a re-send of team A's, so it opened no incident at all. The
    lookups are keyed on (team_id, fingerprint) now, as the index is.

  * Every uniqueness rule was written for one tenant. Two teams watching
    two clusters legitimately see the same fingerprint, the same
    groupKey, and want somebody on call on the same day; all three
    constraints move to include team_id.

Roles inside a team are separate from the system administrator flag: an
owner configures the team, a member works its incidents, and an admin is
NOT implicitly in every team -- administration is about accounts, not
about reading other people's incidents. An admin can still repair a team
whose owner has left, which is why requireTeamOwner lets them through.

A shift can only be given to somebody in the team. Paging a person who
cannot open the incident is worse than paging nobody.

The UI is updated only as far as keeping it working: it loads the
viewer's teams with the session and uses the first one, since nobody has
a second yet. "On call now" shows every team the viewer is in, named only
when there is more than one, so the common case reads exactly as before.
The team switcher, badges and per-team settings pages are the next step.

Breaking for API clients: the schedule endpoints moved under the team,
and /api/schedule/current returns an array rather than an object or a
404. terdut-tui will need a version for that.

Per-team dead-man configuration is deliberately not here. A heartbeat's
incident already opens in the team whose key received it, which is the
part that matters for isolation; moving the matchers out of env into
per-team rows is a change to how deadman.go is configured rather than to
who sees what.

Claude-Session: https://claude.ai/code/session_01RHPj4ggeFdEjKKfm4SHbD7

internal/api/incidents.go

@@ -19,6 +19,15 @@ func handleListIncidents(db *sql.DB) http.HandlerFunc {
 		where := []string{}
 		args := &sqlArgs{}
 
+		// The combined queue: every team the caller belongs to, in one list. A
+		// caller in no team sees an empty queue rather than everybody's.
+		where = append(where, "i.team_id = ANY("+args.add(callerTeamIDs(r.Context()))+")")
+		if team := q.Get("team_id"); team != "" {
+			if n, err := strconv.ParseInt(team, 10, 64); err == nil {
+				where = append(where, "i.team_id = "+args.add(n))
+			}
+		}
+
 		// Without an explicit status the queue shows open work, which is what an
 		// on-call person opens the tool to see.
 		if status := q.Get("status"); status != "" {
@@ -96,7 +105,7 @@ func handleListIncidents(db *sql.DB) http.HandlerFunc {
 
 func handleGetIncident(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -119,7 +128,7 @@ func handleGetIncident(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentAlerts(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -137,7 +146,7 @@ func handleIncidentAlerts(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentTimeline(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -176,7 +185,7 @@ func handleIncidentTimeline(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentAcknowledge(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -199,7 +208,7 @@ func handleIncidentAcknowledge(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentUnacknowledge(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -223,7 +232,7 @@ func handleIncidentUnacknowledge(db *sql.DB) http.HandlerFunc {
 // re-send of an alert that never stopped firing. Use snooze for "not now".
 func handleIncidentResolve(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -244,7 +253,7 @@ func handleIncidentResolve(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentAssign(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -285,7 +294,7 @@ func handleIncidentAssign(db *sql.DB) http.HandlerFunc {
 // {"duration": "2h"}.
 func handleIncidentSnooze(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -340,7 +349,7 @@ func handleIncidentSnooze(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentUnsnooze(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -359,7 +368,7 @@ func handleIncidentUnsnooze(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentArchive(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -379,7 +388,7 @@ func handleIncidentArchive(db *sql.DB) http.HandlerFunc {
 
 func handleIncidentUnarchive(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -401,7 +410,7 @@ func handleIncidentUnarchive(db *sql.DB) http.HandlerFunc {
 // single query renders the whole story of an incident in order.
 func handleCreateNote(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -448,7 +457,7 @@ func handleCreateNote(db *sql.DB) http.HandlerFunc {
 // rest of the timeline is what actually happened, and is not editable.
 func handleDeleteNote(db *sql.DB) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		id, ok := incidentIDParam(w, r)
+		id, ok := incidentIDParam(w, r, db)
 		if !ok {
 			return
 		}
@@ -479,19 +488,32 @@ func handleDeleteNote(db *sql.DB) http.HandlerFunc {
 // Shared handler plumbing
 // ---------------------------------------------------------------------------
 
-func incidentIDParam(w http.ResponseWriter, r *http.Request) (int64, bool) {
+// incidentIDParam reads {id} from the path AND confirms the incident belongs to
+// a team the caller is in. Both in one place, deliberately: every incident route
+// goes through here, so scoping cannot be forgotten by writing a new handler
+// that only remembers the first half.
+//
+// An incident in somebody else's team is reported as not found rather than
+// forbidden, because "there is an incident 41 you may not see" is itself
+// something only that team should know.
+func incidentIDParam(w http.ResponseWriter, r *http.Request, db *sql.DB) (int64, bool) {
 	id, err := strconv.ParseInt(chi.URLParam(r, "id"), 10, 64)
 	if err != nil {
 		respond(w, http.StatusBadRequest, errResp("invalid incident id"))
 		return 0, false
 	}
+	if !incidentExists(w, r, db, id) {
+		return 0, false
+	}
 	return id, true
 }
 
+// incidentExists reports whether the incident is one the caller may see at all.
 func incidentExists(w http.ResponseWriter, r *http.Request, db *sql.DB, id int64) bool {
 	var exists int
 	if err := db.QueryRowContext(r.Context(),
-		"SELECT 1 FROM incidents WHERE id = $1", id).Scan(&exists); err != nil {
+		"SELECT 1 FROM incidents WHERE id = $1 AND team_id = ANY($2)",
+		id, callerTeamIDs(r.Context())).Scan(&exists); err != nil {
 		respond(w, http.StatusNotFound, errResp("incident not found"))
 		return false
 	}