feat(ops): health-fail alerts, optional DB backup, admin UX polish

Wire jobs-worker health probes to Discord/email alerts with cooldown, optional mysqldump, rate-limit /api/health, mark-all-read alerts, ConfirmDialog on destructive admin actions, and raise coverage floors.

Co-authored-by: Cursor <[email protected]>

src/lib/services/alert.ts

@@ -232,6 +232,33 @@ export function emulatorOffline(detail?: string): Promise<SendAlertResult> {
 	});
 }
 
+/**
+ * Raise an ERROR alert when ops health is degraded (DB / Redis / emulator).
+ */
+export function healthDegraded(parts: {
+	database: boolean;
+	redis: boolean | null;
+	emulator: boolean;
+}): Promise<SendAlertResult> {
+	const failed: string[] = [];
+	if (!parts.database) failed.push("database");
+	if (parts.redis === false) failed.push("redis");
+	if (!parts.emulator) failed.push("emulator");
+	return sendAlert({
+		type: "health",
+		severity: parts.database ? "error" : "critical",
+		message:
+			failed.length > 0
+				? `Ops health degraded: ${failed.join(", ")} unavailable.`
+				: "Ops health degraded.",
+		context: {
+			database: parts.database,
+			redis: parts.redis,
+			emulator: parts.emulator,
+		},
+	});
+}
+
 /**
  * Raise a WARNING alert that a possible DDoS / abusive request pattern was
  * detected from a single IP (count = requests seen in the sampling window).