feat: guarantee exactly-once alert effects across workers and delivery channels

[stableprogrammer]

Closes #1022

Summary

• Adds 051_alert_effect_idempotency.ts migration that creates the alert_effect_records table — the idempotency ledger for exactly-once delivery. The unique constraint on effect_key (outboxEventId:channel) is the core guard; INSERT ... ON CONFLICT DO NOTHING makes claim atomicity a property of the database, not the application layer
• Adds AlertEffectGuard service implementing the full exactly-once protocol:
  • claimEffect(eventId, channel, workerId, leaseMs) — atomic single-winner claim across concurrent workers; returns { claimed, isDuplicate, record } so callers know immediately whether to deliver or skip
  • commitEffect(eventId, channel, workerId) — guards the delivered transition behind claimed_by = workerId so a worker whose lease was stolen by crash-recovery cannot commit over a new owner's claim
  • markAmbiguous(eventId, channel, workerId, reason) — records permanently unclear delivery outcomes (e.g. webhook 5xx after network timeout) without triggering automatic retries; records remain visible for operator resolution
  • reclaimExpiredLeases(newWorkerId) — resets expired pending claims so worker crashes at any transaction boundary converge to the same final state rather than leaving slots stuck forever
  • recordDuplicateSuppression(eventId, channel, attemptedBy, reason) — appends an audit row with a unique key when a manual replay or retry is blocked, preserving full audit history without touching the original record
  • getEffectMetrics() — counts pending, delivered, ambiguous, and duplicate-suppressed with per-channel breakdown for Prometheus scraping and operator dashboards
  • buildEffectKey(eventId, channel) — deterministic ${eventId}:${channel} key stable across retries, process restarts, and multiple workers

Test plan

• AC-1: first claim returns claimed=true; second claim on same effect_key returns claimed=false, isDuplicate=true
• AC-1: two different channels on one event can both be claimed independently
• AC-1: concurrent claims produce exactly one winner
• AC-2: commit by owning worker marks delivered; commit by wrong worker returns false
• AC-2: crash after claim, before commit: reclaimExpiredLeases resets the slot; recovery worker commits; exactly one delivered record results
• AC-2: crash after commit: retry attempt finds isDuplicate=true, no second delivery
• AC-3: replay after delivered effect is blocked (isDuplicate=true) and recorded as duplicate_suppressed
• AC-4: markAmbiguous records the reason; listAmbiguous returns the record; reclaimExpiredLeases does not touch ambiguous records
• AC-5: getEffectMetrics counts all four statuses; byChannel breakdown matches per-channel state
• AC-5: total equals sum of all per-status counts

[Mosas2000]

This elegantly bridges the gap between REST state and WebSocket streams, eliminating race conditions with robust catch-up logic and stale cache detection, thank you.