alerting: Alertmanager + Signal relay deliver firing rules to Frank's phone

- dankclaw/observability/quadlet/alertmanager.container: loopback :9093,
  config from shared/prometheus/alertmanager.yml, family conventions
- shared/prometheus/alertmanager.yml: single signal receiver, group_by
  alertname, 30s/5m/4h intervals, webhook to host.containers.internal:18093
- scripts/signal-relay.py + .service: host-side user unit, loopback :18093,
  15-min dedupe, sends via signal-cli account 318311
- prometheus.yml: alerting block to alertmanager:9093; stale comments fixed
- llm-fleet.yml: delivery header; LlmSpecDecodeOff annotation now drafter-agnostic
- deploy.sh/deploy-remote.sh/deploy-plan.py: alertmanager service, config
  copy, relay install, planner routing for config + relay files
- homepage: alertmanager status card (loopback probe)
- tests: alertmanager in UNITS/loopback/health/PAIRS/planner + five new
  delivery-path seams (webhook<->relay contract, prometheus target, relay
  unit, signal-cli account, planner routing)
- docs: Alertmanager.md component page, Observability.md, Prometheus.md,
  index.md, AGENTS.md delivery line

shared/prometheus/alertmanager.yml

@@ -0,0 +1,28 @@
+# Alertmanager configuration for the homelab.
+# Deployed to /opt/alertmanager/config/alertmanager.yml on Dankclaw.
+#
+# The one delivery path is Signal. The webhook lands on the host-side
+# signal-relay (a systemd user unit listening on 127.0.0.1:18093), which
+# formats the group and hands it to signal-cli under Frank's existing
+# account. There is deliberately no second receiver: a duplicate channel is
+# how an alert starts arriving twice and getting muted everywhere.
+#
+# From this container the host's loopback is reachable only as
+# host.containers.internal (169.254.1.2): netavark DNATs published ports
+# only, so the host's LAN IP and the podman gateway are both refused for an
+# unpublished port — the same quirk that 502'd the hermes upstream in the
+# Caddyfile on 2026-09-16.
+global:
+  resolve_timeout: 5m
+
+route:
+  receiver: signal
+  group_by: ['alertname']
+  group_wait: 30s
+  group_interval: 5m
+  repeat_interval: 4h
+
+receivers:
+  - name: signal
+    webhook_configs:
+      - url: http://host.containers.internal:18093/alertmanager