Document received_at and resolution_source as public contract

The API reference listed endpoints but never the alert object's fields, so
two of them were load-bearing for clients while being described nowhere.
received_at appeared only in passing, as a stats filter; resolution_source
only inside the stale-expiry prose.

Both carry meaning a client cannot derive on its own. starts_at comes from
Prometheus and never changes for an alert instance, so received_at is the
only signal that a firing alert is still being refreshed — it advances on
every accepted webhook, including the unchanged notifications Alertmanager
re-sends every repeat_interval. resolution_source then says how much to
trust ends_at: under 'alertmanager' it is an end time somebody reported,
but under 'expiry' nothing ever reported one, so it is either a stale
watermark or the sweep timestamp, and only an upper bound.

README gains an alert object field table plus a contract section for each,
including the nullability rules and the advice to tolerate unrecognised
resolution_source values. The field comments in models.Alert now say these
are public API rather than ingest details, and the upsert carries a note at
the received_at line, which is where a regression would be introduced.

Three tests lock the newly documented behaviour, none of which was covered
before — the whole suite passed with the received_at bump deleted from the
upsert, because the expiry tests only ever set that column via SQL:

  - a re-send advances received_at and leaves starts_at alone
  - a discarded out-of-order retry does not count as a heartbeat
  - an expiry resolve preserves a reported ends_at watermark and stamps
    sweep time only when none was known

internal/api/alertmanager.go

@@ -79,6 +79,10 @@ func handleAlertmanagerWebhook(db *sql.DB) http.HandlerFunc {
 					starts_at         = excluded.starts_at,
 					ends_at           = excluded.ends_at,
 					generator_url     = excluded.generator_url,
+					-- Load-bearing: advancing received_at on every accepted
+					-- payload, re-sends included, is the documented liveness
+					-- heartbeat clients and the sweeper both read. Removing it
+					-- is a breaking API change — see models.Alert.ReceivedAt.
 					received_at       = excluded.received_at,
 					resolution_source = excluded.resolution_source,
 					-- A re-fire makes the alert current again, so it leaves the archive.