alert: wire engine into ws hello + MarkJobFinished + offline sweep

- ws.HandlerDeps gains an AlertEngine *alert.Engine field; populated
  from http.Deps.AlertEngine (nil until G1 constructs the engine)
- runAgentLoop calls NotifyHostOnline after MarkHostHello succeeds
- dispatchAgentMessage MsgJobFinished case calls NotifyJobFinished,
  looking up the job Kind via Store.GetJob before notifying
- store.MarkHostsOfflineStaleReturnIDs added: SELECT+UPDATE in one
  transaction, returns the IDs that flipped to offline
- offline sweeper in cmd/server/main.go switched to the new variant;
  TODO(G1) comment marks where NotifyHostOffline calls will land

cmd/server/main.go

@@ -175,8 +175,11 @@ func run() error {
 				}
 			case <-offlineTick.C:
 				cutoff := time.Now().Add(-90 * time.Second)
-				if n, err := st.MarkHostsOfflineStale(ctx, cutoff); err == nil && n > 0 {
-					slog.Info("marked hosts offline (stale heartbeat)", "n", n)
+				if ids, err := st.MarkHostsOfflineStaleReturnIDs(ctx, cutoff); err == nil && len(ids) > 0 {
+					slog.Info("marked hosts offline (stale heartbeat)", "n", len(ids))
+					// TODO(G1): notify engine once deps.AlertEngine is wired.
+					// for _, id := range ids { alertEngine.NotifyHostOffline(id) }
+					_ = ids
 				}
 			case <-pendingDrainTick.C:
 				srv.DrainAllDue(ctx)