List dead man's switches with their status on Team -> Switches

The page was a bare form: it did not say which switches existed or
whether they were alive. It now lists them, each with a Healthy, Dead or
Dormant badge, when its heartbeat was last heard and when it last opened
an incident (linked while that incident is open). A matcher that several
clusters satisfy is broken down per cluster, since a live cluster must
not hide a dead one. The form moved into a "New switch" sheet, and each
row has a Remove with a confirm.

That needed a switch to be a thing, so switches are rows now
(migration 009) with their own name, matcher, timeout and severity,
instead of one string with one team-wide timeout in deadman_configs.
Existing configuration is split into one row per matcher; a team whose
timeout was zero simply has none. The sweeper and the status endpoint
share one death rule (deadmanAlert.dead), so the page cannot disagree
with the pager. Incident group keys are unchanged, so incidents that
are open across the upgrade keep working.

The environment defaults (TERDUT_DEADMAN_*) are seeded into teams once
per install, recorded in settings, so a team that deletes its last
switch does not get it back on the next restart. Installs that already
had per-team rows are marked as seeded by the migration.

Removing a switch stops the watching but leaves an incident it already
opened open until someone resolves it.

API: GET/PUT /api/teams/{id}/deadman are replaced by
GET/POST /deadman/switches and DELETE /deadman/switches/{switchID}.
terdut-tui does not call them, so nothing to mirror there.

internal/db/migrations/009_deadman_switches.sql

@@ -0,0 +1,54 @@
+-- Dead man's switches become rows of their own.
+--
+-- 004 kept a team's switches in one string with one timeout and one severity,
+-- which was enough to configure them and not enough to show them: there was no
+-- thing to list, nothing to hang a status on, and every switch in a team had to
+-- share a deadline. A row per switch gives each its own name, matcher, timeout
+-- and severity, and gives the Team → Switches page something to be a list of.
+--
+-- The matcher keeps the syntax the string used, one matcher per row:
+-- `alertname=Watchdog,cluster=prod`. The unit of monitoring is still the
+-- fingerprint, so a matcher that many clusters satisfy is still one switch row
+-- watching several independent heartbeats.
+CREATE TABLE deadman_switches (
+    id      BIGSERIAL PRIMARY KEY,
+    team_id BIGINT NOT NULL REFERENCES teams(id) ON DELETE CASCADE,
+
+    -- What the owner calls it. Defaults to the matcher when they do not say.
+    name TEXT NOT NULL,
+
+    -- "," separates the label conditions, "=" is exact equality, and alertname is
+    -- mandatory: it is what keeps the sweeper's candidate query on an index.
+    matcher TEXT NOT NULL,
+
+    -- Seconds of silence before the switch is declared dead. Never zero: a switch
+    -- that cannot fire is deleted, not disabled.
+    timeout_seconds BIGINT NOT NULL CHECK (timeout_seconds > 0),
+
+    -- The severity its incidents open at. See 004 for why they carry their own.
+    severity TEXT NOT NULL DEFAULT 'critical',
+
+    created_at BIGINT NOT NULL DEFAULT FLOOR(EXTRACT(EPOCH FROM now()))::bigint
+);
+
+CREATE INDEX deadman_switches_team_idx ON deadman_switches (team_id);
+
+-- Carry every team's configuration over, one row per matcher. A team whose
+-- timeout was zero had switches turned off, which is now "no rows".
+INSERT INTO deadman_switches (team_id, name, matcher, timeout_seconds, severity)
+SELECT c.team_id, btrim(m), btrim(m), c.timeout_seconds, c.severity
+FROM   deadman_configs c,
+       LATERAL regexp_split_to_table(c.matchers, ';') AS m
+WHERE  c.timeout_seconds > 0
+  AND  btrim(m) <> ''
+ORDER  BY c.team_id;
+
+-- The server seeds environment defaults into teams once, and remembers that it
+-- did. An install that had a row per team was already seeded; without this
+-- marker the first start after upgrading would seed teams that had switched
+-- theirs off.
+INSERT INTO settings (key, value)
+SELECT 'deadman_seeded', '1'
+WHERE  EXISTS (SELECT 1 FROM deadman_configs);
+
+DROP TABLE deadman_configs;