Graph the metric behind each alert on the incident page

Each alert carries a generatorURL pointing at the Prometheus rule that fired
it. The server now parses that link, queries the same Prometheus for the
rule's expression and draws it under the alert, with the current value
beside it. The browser never talks to Prometheus, so the CSP stays at
connect-src 'self'.

The URL comes out of a webhook payload, so whoever holds an integration key
chooses it. Querying it is therefore opt-in and bounded by an allowlist,
TERDUT_PROMETHEUS_ALLOWED_HOSTS (names, "*" as one label, a leading "**" as
several, IPs, CIDRs). The check runs on the address the dialer is about to
use, a name that resolves to loopback or link-local is refused even when it
matches, and redirects and proxy variables are ignored.

A worker takes a snapshot when an incident opens and another when it
closes, so the graph outlives Prometheus' retention. It finds its work in
the database rather than being triggered from the webhook, so ingestion is
untouched and a restart loses nothing. While an incident is open the
metrics endpoint also queries live, cached for 15 seconds.

The rule expression keeps its threshold, so Prometheus returns data only
while the alert condition holds; "no data" for the current value means the
condition cleared. Stripping the threshold needs a PromQL parser and is left
out.

Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN

internal/config/config.go

@@ -8,6 +8,8 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"git.ryuvia.com/niklas/terdut-server/internal/prom"
 )
 
 // MinOperatorKeyLength is the shortest TERDUT_OPERATOR_KEY accepted: it is a
@@ -79,6 +81,20 @@ type Config struct {
 	// "where this server is plugged in" — it is a statement about who owns
 	// this install's configuration, not a per-request toggle.
 	OperatorMode bool
+
+	// PrometheusAllowedHosts lists the Prometheus servers this install may query
+	// for the metrics behind an alert, matched against the host in each alert's
+	// generatorURL. Entries are host names (with "*" and a leading "**" as
+	// wildcards), IPs or CIDR ranges, optionally with a port; see prom.Allowlist.
+	// Empty turns the feature off, which is the default: the URL comes from a
+	// webhook payload, so querying it is opt-in.
+	PrometheusAllowedHosts []string
+
+	// PrometheusPreroll is how far before an alert started its graph begins.
+	PrometheusPreroll time.Duration
+
+	// PrometheusTimeout bounds one request to a Prometheus.
+	PrometheusTimeout time.Duration
 }
 
 // OIDC is the single sign-on configuration. Groups from the provider decide
@@ -151,6 +167,10 @@ func Load() Config {
 		OIDC:           loadOIDC(),
 
 		OperatorMode: boolean("TERDUT_OPERATOR_MODE", false),
+
+		PrometheusAllowedHosts: list("TERDUT_PROMETHEUS_ALLOWED_HOSTS", ""),
+		PrometheusPreroll:      duration("TERDUT_PROMETHEUS_PREROLL", time.Hour),
+		PrometheusTimeout:      duration("TERDUT_PROMETHEUS_TIMEOUT", 10*time.Second),
 	}
 }
 
@@ -180,6 +200,9 @@ func (c Config) Validate() error {
 	if c.OperatorKey != "" && len(c.OperatorKey) < MinOperatorKeyLength {
 		return fmt.Errorf("TERDUT_OPERATOR_KEY must be at least %d characters", MinOperatorKeyLength)
 	}
+	if _, err := prom.ParseAllowlist(c.PrometheusAllowedHosts); err != nil {
+		return fmt.Errorf("TERDUT_PROMETHEUS_ALLOWED_HOSTS: %w", err)
+	}
 	o := c.OIDC
 	if !o.Enabled() {
 		if c.DisablePasswordLogin {