feat(ops): health-fail alerts, optional DB backup, admin UX polish

Wire jobs-worker health probes to Discord/email alerts with cooldown, optional mysqldump, rate-limit /api/health, mark-all-read alerts, ConfirmDialog on destructive admin actions, and raise coverage floors.

Co-authored-by: Cursor <[email protected]>

src/actions/admin-alerts.ts

@@ -1,7 +1,9 @@
 "use server";
 
+import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
+import { AlertLogs, db } from "@/lib/db";
 import { PERMS } from "@/lib/permissions";
 import { rcon } from "@/lib/services/rcon";
 
@@ -29,3 +31,17 @@ export async function sendHotelAlert(formData: FormData): Promise<void> {
 
 	revalidatePath("/admin/alerts");
 }
+
+/** Mark every unread ops alert as read. */
+export async function markAllAlertsRead(): Promise<void> {
+	await requirePermission(PERMS.NOTIFICATIONS_VIEW);
+	try {
+		await db
+			.update(AlertLogs)
+			.set({ isRead: true, updatedAt: new Date() })
+			.where(eq(AlertLogs.isRead, false));
+	} catch {
+		/* ignore */
+	}
+	revalidatePath("/admin/alerts");
+}