alerting: Alertmanager + Signal relay deliver firing rules to Frank's phone

- dankclaw/observability/quadlet/alertmanager.container: loopback :9093,
  config from shared/prometheus/alertmanager.yml, family conventions
- shared/prometheus/alertmanager.yml: single signal receiver, group_by
  alertname, 30s/5m/4h intervals, webhook to host.containers.internal:18093
- scripts/signal-relay.py + .service: host-side user unit, loopback :18093,
  15-min dedupe, sends via signal-cli account 318311
- prometheus.yml: alerting block to alertmanager:9093; stale comments fixed
- llm-fleet.yml: delivery header; LlmSpecDecodeOff annotation now drafter-agnostic
- deploy.sh/deploy-remote.sh/deploy-plan.py: alertmanager service, config
  copy, relay install, planner routing for config + relay files
- homepage: alertmanager status card (loopback probe)
- tests: alertmanager in UNITS/loopback/health/PAIRS/planner + five new
  delivery-path seams (webhook<->relay contract, prometheus target, relay
  unit, signal-cli account, planner routing)
- docs: Alertmanager.md component page, Observability.md, Prometheus.md,
  index.md, AGENTS.md delivery line

scripts/deploy-plan.py

@@ -38,6 +38,7 @@ SERVICE_ORDER = (
     "loki",
     "alloy",
     "node-exporter",
+    "alertmanager",
     "authentik-postgres",
     "authentik-server",
     "authentik-worker",
@@ -83,6 +84,7 @@ DANKCLAW_SERVICES = {
     "loki",
     "alloy",
     "node-exporter",
+    "alertmanager",
     "authentik-postgres",
     "authentik-server",
     "authentik-worker",
@@ -246,6 +248,10 @@ def services_for_path(path: str, target: str) -> set[str]:
             _add(services, "searxng")
         elif group == "prometheus":
             _add(services, "prometheus")
+            if len(parts) >= 3 and parts[2] == "alertmanager.yml":
+                # The Alertmanager config ships from this directory: a change
+                # to it must redeploy the service that installs it.
+                _add(services, "alertmanager")
         elif group == "loki":
             _add(services, "loki")
         elif group == "alloy":
@@ -320,7 +326,7 @@ def services_for_path(path: str, target: str) -> set[str]:
             # consumer (prometheus before grafana, loki before alloy).
             if len(parts) >= 4 and parts[2] == "quadlet":
                 name = parts[3].removesuffix(".container")
-                if name in {"prometheus", "grafana", "loki", "alloy", "node-exporter"}:
+                if name in {"prometheus", "grafana", "loki", "alloy", "node-exporter", "alertmanager"}:
                     _add(services, name)
             return services
         if len(parts) >= 2 and parts[1] == "gitea":
@@ -391,6 +397,11 @@ def services_for_path(path: str, target: str) -> set[str]:
         name = p.name
         if name in {"homepage-status.py", "homepage-status.service", "homepage-status.timer"}:
             _add(services, "homepage")
+        if name in {"signal-relay.py", "signal-relay.service"}:
+            # The Signal relay is installed by the alertmanager deploy, so a
+            # change to it redeploying alertmanager is the only path that
+            # reaches it on the host.
+            _add(services, "alertmanager")
         if name in {"frank-small.env", "frank-small.service", "serve-frank-small.sh"}:
             # llama.cpp frank-small (2026-09-16) keeps its unit, env and serve
             # files here; each one selects frank-small only. The ik_llama.cpp