feat(web): add opt-in webhook alert actions

An optional actions block in the config adds buttons to alerts. POST
/api/actions/{id} checks that the repository and the current alert match,
then sends the alert as JSON to the configured webhook with an optional
bearer token. The request refuses cross-site callers like POST /refresh.

GET /api/state lists the actions and merges per-alert status rows from an
optional status_url, cached for 10 seconds. Without an actions block the
API output does not change.

The ghtracker_action_requests_total counter records each result.

config.example.yaml

@@ -14,6 +14,18 @@ thresholds: # negative disables a check
   issue_stale_after: 720h # no activity this long = warning (aggregated per repo)
   workflow_stuck_after: 6h # queued / in progress this long = warning
 
+# Optional buttons on alerts. Each one POSTs the alert as JSON to a webhook. Omit the block to turn the feature off.
+# actions:
+#   - id: rerun # [a-z0-9-]+
+#     label: Re-run # button text
+#     kinds: [workflow_failed] # omit for every alert kind
+#     webhook:
+#       url: https://example.internal/hooks/rerun
+#       token_env: ACTION_TOKEN # env var holding a bearer token; optional
+#       timeout: 10s
+#     status_url: https://example.internal/hooks/rerun/status # optional
+#     confirm: "Run this action for the selected alert?" # optional; omit for no dialog
+
 max_items: 100 # per repo, issues and PRs
 concurrency: 2