alerting: Alertmanager + Signal relay deliver firing rules to Frank's phone

- dankclaw/observability/quadlet/alertmanager.container: loopback :9093,
  config from shared/prometheus/alertmanager.yml, family conventions
- shared/prometheus/alertmanager.yml: single signal receiver, group_by
  alertname, 30s/5m/4h intervals, webhook to host.containers.internal:18093
- scripts/signal-relay.py + .service: host-side user unit, loopback :18093,
  15-min dedupe, sends via signal-cli account 318311
- prometheus.yml: alerting block to alertmanager:9093; stale comments fixed
- llm-fleet.yml: delivery header; LlmSpecDecodeOff annotation now drafter-agnostic
- deploy.sh/deploy-remote.sh/deploy-plan.py: alertmanager service, config
  copy, relay install, planner routing for config + relay files
- homepage: alertmanager status card (loopback probe)
- tests: alertmanager in UNITS/loopback/health/PAIRS/planner + five new
  delivery-path seams (webhook<->relay contract, prometheus target, relay
  unit, signal-cli account, planner routing)
- docs: Alertmanager.md component page, Observability.md, Prometheus.md,
  index.md, AGENTS.md delivery line

scripts/signal-relay.service

@@ -0,0 +1,37 @@
+# Systemd USER unit: signal-relay (Dankclaw).
+#
+# Install path: ~/.config/systemd/user/signal-relay.service
+# Installed and enabled by install_signal_relay in scripts/deploy-remote.sh
+# (part of the alertmanager deploy).
+#
+# The webhook consumer for Alertmanager: it listens on loopback only and is
+# the only thing on this host that talks to signal-cli. It is a plain user
+# unit, not a quadlet, on purpose:
+#
+#   * it runs python3 straight from the checkout, so a deploy updates the
+#     relay without a copy step (the homepage timer copies to
+#     /usr/local/bin; this one has no root side);
+#   * generated quadlet units cannot be enabled on this host's podman 5.x
+#     v1 generator — a hand-written user unit can, and with Linger=yes for
+#     dank it starts at boot;
+#   * it needs no container: its only dependencies are /usr/bin/python3
+#     (system) and /usr/local/bin/signal-cli (host install, account state
+#     under ~/.local/share/signal-cli).
+#
+# Loopback-only for the same reason every observability port is: an
+# unauthenticated message-sending endpoint has no business on a host
+# interface. Alertmanager reaches it from its container via
+# host.containers.internal.
+
+[Unit]
+Description=Alertmanager-to-Signal relay (Dankclaw)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+ExecStart=/usr/bin/python3 /home/dank/serverAppConfigs/scripts/signal-relay.py
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target