feat(alerts): rule engine, recurring evaluator, socket fanout

PR2 of Phase B. Wires the alert framework end-to-end:

- alert-rules.ts: 10 rule evaluators implemented as pure async fns over
  the existing schema. reservation.no_agreement, interest.stale,
  document.signer_overdue, berth.under_offer_stalled, expense.duplicate,
  expense.unscanned, interest.high_value_silent, eoi.unsigned_long,
  audit.suspicious_login fire against real conditions.
  document.expiring_soon stays inert until the documents schema gets an
  expires_at column. audit.suspicious_login also stays inert until the
  auth layer logs 'login.failed' rows (TODO noted in the rule body).

- alert-engine.ts: runAlertEngine() walks every port × every rule and
  calls reconcileAlertsForPort. Errors per (port, rule) are collected
  in the summary, not thrown — one bad evaluator can't stop the sweep.

- alerts.service.ts: reconcileAlertsForPort now emits 'alert:created'
  socket events on insert and 'alert:resolved' on auto-resolve;
  dismissAlert emits 'alert:dismissed'. All scoped to port:{portId}
  rooms.

- socket/events.ts: adds the three Server→Client alert event types.

- queue/scheduler.ts: registers 'alerts-evaluate' on the maintenance
  queue with cron */5 * * * * (every 5 min, per spec risk register).

- queue/workers/maintenance.ts: dispatches 'alerts-evaluate' to
  runAlertEngine; logs sweep summary.

Tests:
- tests/integration/alerts-engine.test.ts (6 cases): seeds reservation
  → fires, runs twice → no dupe, adds agreement → auto-resolves; seeds
  stale interest → fires; hot lead silent → critical; engine summary
  shape on no-data port. Socket emit module is vi.mocked.

Vitest 681/681 (was 675; +6). tsc clean. Lint clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/queue/scheduler.ts

@@ -14,39 +14,42 @@ interface RecurringJobDef {
 export async function registerRecurringJobs(): Promise<void> {
   const recurring: RecurringJobDef[] = [
     // Documenso signature fallback poll — primary is webhooks, this is safety net
-    { queue: 'documents',     name: 'signature-poll',         pattern: '0 */6 * * *'   },
+    { queue: 'documents', name: 'signature-poll', pattern: '0 */6 * * *' },
 
     // Reminder checks
-    { queue: 'notifications', name: 'reminder-check',         pattern: '0 * * * *'     },
-    { queue: 'notifications', name: 'reminder-overdue-check', pattern: '*/15 * * * *'  },
+    { queue: 'notifications', name: 'reminder-check', pattern: '0 * * * *' },
+    { queue: 'notifications', name: 'reminder-overdue-check', pattern: '*/15 * * * *' },
 
     // Google Calendar background sync
-    { queue: 'maintenance',   name: 'calendar-sync',          pattern: '*/30 * * * *'  },
+    { queue: 'maintenance', name: 'calendar-sync', pattern: '*/30 * * * *' },
 
     // Daily checks at 08:00
-    { queue: 'notifications', name: 'invoice-overdue-check',  pattern: '0 8 * * *'     },
-    { queue: 'notifications', name: 'tenure-expiry-check',    pattern: '0 8 * * *'     },
+    { queue: 'notifications', name: 'invoice-overdue-check', pattern: '0 8 * * *' },
+    { queue: 'notifications', name: 'tenure-expiry-check', pattern: '0 8 * * *' },
 
     // Exchange rate refresh every 6 hours
-    { queue: 'maintenance',   name: 'currency-refresh',       pattern: '0 */6 * * *'   },
+    { queue: 'maintenance', name: 'currency-refresh', pattern: '0 */6 * * *' },
 
     // Database backup / cleanup
-    { queue: 'maintenance',   name: 'database-backup',        pattern: '0 2 * * *'     },
-    { queue: 'maintenance',   name: 'backup-cleanup',         pattern: '0 3 * * 0'     }, // Sunday 03:00
+    { queue: 'maintenance', name: 'database-backup', pattern: '0 2 * * *' },
+    { queue: 'maintenance', name: 'backup-cleanup', pattern: '0 3 * * 0' }, // Sunday 03:00
 
     // Session cleanup
-    { queue: 'maintenance',   name: 'session-cleanup',        pattern: '0 4 * * *'     },
+    { queue: 'maintenance', name: 'session-cleanup', pattern: '0 4 * * *' },
 
     // Report scheduler — checks every minute for reports due to run
-    { queue: 'reports',       name: 'report-scheduler',       pattern: '* * * * *'     },
+    { queue: 'reports', name: 'report-scheduler', pattern: '* * * * *' },
 
     // Notification digest — configurable per user; placeholder fires hourly
     // TODO(L2): make per-user schedule configurable (read from user_settings)
-    { queue: 'email',         name: 'notification-digest',    pattern: '0 * * * *'     },
+    { queue: 'email', name: 'notification-digest', pattern: '0 * * * *' },
 
     // Cleanup jobs
-    { queue: 'maintenance',   name: 'temp-file-cleanup',      pattern: '0 5 * * *'     },
-    { queue: 'maintenance',   name: 'form-expiry-check',      pattern: '0 * * * *'     },
+    { queue: 'maintenance', name: 'temp-file-cleanup', pattern: '0 5 * * *' },
+    { queue: 'maintenance', name: 'form-expiry-check', pattern: '0 * * * *' },
+
+    // Phase B: alert rule engine sweep
+    { queue: 'maintenance', name: 'alerts-evaluate', pattern: '*/5 * * * *' },
   ];
 
   for (const job of recurring) {
@@ -56,7 +59,10 @@ export async function registerRecurringJobs(): Promise<void> {
       { pattern: job.pattern },
       { data: {}, name: job.name },
     );
-    logger.info({ queue: job.queue, job: job.name, pattern: job.pattern }, 'Registered recurring job');
+    logger.info(
+      { queue: job.queue, job: job.name, pattern: job.pattern },
+      'Registered recurring job',
+    );
   }
 
   logger.info({ count: recurring.length }, 'All recurring jobs registered');