Default alerting with Prometheus rules and bundled Alertmanager

The gateway now ships with a default Prometheus alert rule set and a bundled Alertmanager service so a fresh install can page an operator without any custom monitoring stack.

Default rules cover gateway-down, elevated 5xx error rate, p95 request latency above threshold, Celery queue backlog, and firewall block spikes. Alertmanager exposes its admin surface on port 9093, bound to loopback by the same policy as the rest of the admin plane, and routes alerts by email to the address set in ALERT_EMAIL_TO.

Operators already running Prometheus and Alertmanager can point their existing stack at the new rule files and disable the bundled service.

No action required for SaaS tenants. Self-hosted operators should set ALERT_EMAIL_TO to receive notifications; if unset, alerts fire but are not delivered.