feat: implement alert deduplication and storm protection (Tasks 6 + 7)

[itenev]

What this PR does

Adds two critical alert management features to the webhook receiver:

Task 6 — Deduplication Logic
- Prevents duplicate alerts from flooding the pipeline when the same issue re-fires within a cooldown window
- Cooldown windows by severity: critical=15m, high=1h, medium=4h
- Read-only SQLite lookup against the incidents table
- Five rules:
  1. No prior incident → always process
  2. Resolved → firing transition → always process
  3. Higher severity breaks dedup (critical > high > medium > low)
  4. Cooldown elapsed → process
  5. Otherwise → deduplicate (skip)
- Fails open: if the SQLite DB is unavailable or unreadable, alerts always process (no alerts lost)
- Handles both timezone-naive and timezone-aware datetimes

Task 7 — Alert Storm Protection
- Bundles alerts during storm events to prevent operator fatigue
- Single-host storm: >3 alerts for same host within 30s → bundled as storm_single_host
- Cross-host storm: same alert type across >=2 hosts within 60s → bundled as storm_cross_host (always critical severity)
- Bundled alerts are written as a single JSONL entry with severity inheritance (critical if any bundled alert is critical)
- Automatic counter reset after bundle creation to allow subsequent storms
- Expired entry cleanup to prevent memory leaks

Files changed

| File                                                      | Description                                           |
|-----------------------------------------------------------|-------------------------------------------------------|
| webhook-receiver/src/webhook_receiver/dedup.py            | DedupLookup class + should_process() logic            |
| webhook-receiver/src/webhook_receiver/storm_protection.py | StormTracker + AlertBundle                            |
| webhook-receiver/src/webhook_receiver/server.py           | Integrated both features into WebhookHandler pipeline |
| webhook-receiver/tests/test_dedup.py                      | 13 dedup unit tests                                   |
| webhook-receiver/tests/test_storm_protection.py           | 15 storm protection + 2 AlertBundle unit tests        |
| webhook-receiver/tests/test_server.py                     | 5 dedup integration + 4 storm integration tests       |
| docs/hermes-implementation-plan.md                        | Tasks 5, 6, 7 marked complete                         |

Processing pipeline

The webhook handler now processes alerts in three phases:


validate → dedup → storm protection → write to JSONL


- Deduped alerts are skipped (tracked in alerts_deduped)
- Storm-bundled alerts replace individual entries (tracked in alerts_bundled)
- Health endpoint reports all three counters: alerts_received, alerts_deduped, alerts_bundled
- Response includes deduped_ids and bundled_ids lists

Test results

- 90 tests passing (30 parent project + 60 webhook-receiver)
- Covers: schema validation, dedup rules, storm thresholds, severity inheritance, expiry, integration with HTTP endpoints

╰───