Phase 1 Summary

Implemented Phase 1 foundations for production use:

Basic auth protects UI/API routes; /healthz remains unauthenticated.
Loki diagnostics endpoints were added for labels, label values, and limited query testing.
Rules now support per-rule cooldowns with default 1h and duplicate incident suppression.
Alert channels are configurable in the UI.
Real self-hosted ntfy delivery is implemented with test-send support.
Gotify, generic webhook, and SMTP channel types are represented as scaffolded options.
Incidents can record alert delivery results and remediation dry-run evidence.
Remediation action runner supports guarded dry-run evidence for generic webhook, Portainer restart, allowlisted command, and recommendation actions.
Local-only Ollama analysis support was added and remains disabled by default.
Secret handling was improved for alert channel token preservation and display masking.

Phase 1 production rollout still requires live validation against the user's remote Loki and self-hosted ntfy deployments.