Act on the wj architectural review: races, limits, pool and contract gaps

Findings F2, F4, F5, F6, F7, F8, F9, F10, F11 and F13 from
wj-architectural-review.md. F1/F1a (the non-sargable LOWER pattern) and F3
(the warranty sync holding a pooled connection) are being handled separately
and are untouched here.

- A collector check-in that raced another for the same PC lost everything:
  the unique index on the application fingerprint raised, nothing caught it,
  and the whole check-in rolled back, discarding state, events and hardware,
  answering the agent with form copy meant for a person. The insert now runs
  in a savepoint, reconciles what the other transaction already wrote, one row
  per savepoint so a second collision skips a row rather than the batch, and
  the check-in commits with a warning. This is the shape the delete side of
  the same function already had.
- Enrollment is deliberately unauthenticated, so it now carries a per-address
  rate limit and a cap on pending requests, and the cap is a setting an admin
  can see and change. A flood can no longer bury the approval queue or grow
  the table without bound.
- The fleet alert poll no longer formats debug strings on every request.
- BusinessUnit is on the contract surface (0.34.0), so the endpoints plugin
  stops reaching into a core table with raw SQL.
- A test walks every asset type descriptor and proves the endpoint it names
  really refuses a caller without the declared permission.
- The plugin settings routes now need a permission; they were telling anyone
  which modules a site runs and where its components live.
- The connection pool is sized explicitly with a short timeout, and the
  arithmetic against the server's connection ceiling is written next to the
  worker count instead of being left to defaults nobody chose.
- Fleet alerts carry both the correct lowercase keys and the old camelCase
  pair. Trays older than 1.7.0 match keys case-sensitively and would have gone
  quiet on every PC not yet upgraded; the old pair goes when they are.
- The dev server proxy points at localhost again, with environment variables
  for the remote-box workflow, and one developer's address is out of the
  server certificate page.

plugins/endpoints/AGENT-CONTRACT.md

@@ -872,3 +872,33 @@ The generated script:
   route and adding one would hand an anonymous caller a way to probe the fleet.
 
 Exit code 0 on install success even when the PC is still pending.
+
+### 9.9 Fleet alert feed
+
+`GET /api/endpoints/alerts?hostname=<host>` returns the alerts that should be
+live on that PC right now (see the AUTHORITATIVE rule above). One object per
+alert:
+
+| Key | Type | Meaning |
+|---|---|---|
+| `notificationid` | int | the notification, and the id posted back to `/alerts/<id>/acknowledge` |
+| `type` | string | notification type name |
+| `typecolor` | string | CSS colour the tray paints the toast with |
+| `title` | string | first line of the message, max 100 chars |
+| `message` | string | full message |
+| `timeout` | int or null | seconds the toast stays on screen |
+
+Response keys match the column names, per the naming convention. Two extra keys
+ride along for now:
+
+| Legacy key | Same value as | Remove when |
+|---|---|---|
+| `notificationId` | `notificationid` | no tray older than 1.7.0 is left in the fleet |
+| `typeColor` | `typecolor` | no tray older than 1.7.0 is left in the fleet |
+
+A tray at 1.6.x fetches this feed itself and deserializes case-sensitively, so
+serving only the lowercase keys makes every alert vanish on those machines with
+no error raised anywhere. Both spellings therefore go down with identical
+values until the fleet is upgraded, and the camelCase pair is deleted in the
+same release that drops support for trays below 1.7.0. Any NEW field on this
+object is lowercase only and never gets a camelCase twin.