Stage 4: alert acknowledgement and comments

- Migration 004: acknowledged_by/acknowledged_at columns on alerts,
  alert_comments table (FK cascade on delete)
- POST /api/alerts/{id}/acknowledge — stamps authed user + timestamp,
  returns updated alert with acknowledged_by username
- DELETE /api/alerts/{id}/acknowledge — clears ack (204)
- GET /api/alerts/{id}/comments — list in chronological order
- POST /api/alerts/{id}/comments — add comment (returns 201)
- DELETE /api/alerts/{id}/comments/{commentID} — own comments only (204)
- All alert queries now LEFT JOIN users for ack username

internal/api/router.go

@@ -33,6 +33,11 @@ func NewRouter(db *sql.DB) http.Handler {
 
 		r.Get("/api/alerts", handleListAlerts(db))
 		r.Get("/api/alerts/{id}", handleGetAlert(db))
+		r.Post("/api/alerts/{id}/acknowledge", handleAcknowledge(db))
+		r.Delete("/api/alerts/{id}/acknowledge", handleUnacknowledge(db))
+		r.Get("/api/alerts/{id}/comments", handleListComments(db))
+		r.Post("/api/alerts/{id}/comments", handleCreateComment(db))
+		r.Delete("/api/alerts/{id}/comments/{commentID}", handleDeleteComment(db))
 	})
 
 	return r