ClickHouse Alert Context Hydration

Alert detail drawers now fetch persisted investigative context from ClickHouse by alert trace id, then merge linked flow packets and option prints into the existing pinned evidence maps.

Validated

Summary

This change makes alert details durable. Selecting an alert no longer depends only on the live cache to resolve evidence; the terminal asks the API for a ClickHouse-backed alert context bundle and uses that bundle to populate the existing drawer, classifier support, smart-money support, and prefetch evidence stores.

Changes Made

Context

Alert rows intentionally remain lightweight for live bursts. The detail drawer is the right place to hydrate heavier investigative context because it runs only when a user asks for a specific alert. The authoritative linkage remains AlertEvent.evidence_refs.

Important Implementation Details

The new API response shape is:

{
  alert: AlertEvent | null,
  flow_packets: FlowPacket[],
  option_prints: OptionPrint[],
  missing_refs: string[]
}

Flow packet refs are resolved with both prefixed and unprefixed candidates. Option print refs are resolved by trace_id. Missing refs are returned explicitly instead of failing the whole response.

Expected Impact for End-Users

Alert details should feel more trustworthy after cache churn or replay navigation. Users can select an older or non-hot alert and still see the preserved evidence context needed to evaluate the signal.

Validation

Issues, Limitations, and Mitigations

Follow-up Work

No follow-up beads issue was filed. The requested storage, API, frontend, tests, build, and documentation work is complete.