feat(security): ops alerts, shared backoff, atomic quota and daily stats for CrowdSec

Add an alerting/stats layer over the existing CrowdSec integration:

- New crowdsec-alerts.ts: cooldown-gated ops alerts (Redis NX lock, TTL from
  HEALTH_ALERT_COOLDOWN_MIN) fanning out through the app's sendAlert service.
  Raised for daily quota exhaustion, block bursts (5-min window past
  CROWDSEC_ALERT_BLOCK_BURST), and signal-push failures.
- New crowdsec-stats.ts: daily counters (lookups/blocks/reports/report_fail)
  in Redis with a 14-day reader for the admin panel.
- Shared 403/429 backoff: the pause marker now lives in Redis
  (crowdsec:backoff-until) so every instance honours it, not just the process
  that hit the limit.
- Atomic quota reservation: INCR-before-call with self-rollback on overshoot,
  so concurrent instances can never slip calls past the daily ceiling.
- Admin anti-DDoS page gains a last-14-days activity table next to the quota bar.

src/env.ts

@@ -182,6 +182,9 @@ const schema = z
 		// it, so a spread DDoS can never silently burn the whole quota; 0
 		// disables the guard.
 		CROWDSEC_CTI_DAILY_QUOTA: z.coerce.number().int().min(0).default(10_000),
+		// How many new community-reputation blocks within a 5-minute window
+		// justify an ops alert (cooldown-gated via HEALTH_ALERT_COOLDOWN_MIN).
+		CROWDSEC_ALERT_BLOCK_BURST: z.coerce.number().int().min(1).default(10),
 		// Share our own detections back into the CrowdSec community blocklist
 		// (signal push over the Central API). Opt-in: flipping this on publicly
 		// shares blocked IPs + behaviors, so it defaults to off.