feat(api): phase 5 — alerts, agent depth, subdomains, auth, boards

P5b: notifier transport registry (webhook/slack/discord/telegram/
gotify/ntfy/smtp via net/smtp), per-monitor+domain alert rules
(failsBeforeDown, latencyWarn, certDays, mute).

P5c: per-container cpu/mem, optional SMART/ZFS/GPU exec-or-skip
collectors, crt.sh subdomain discovery with daily sweep.

P5d: opt-in auth (bcrypt, sqlite sessions, 7d rotating cookie, login
rate limit, public-route bypass) and multiple boards (boards table,
sections.board_id, /api/boards CRUD, slug routing).

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/db/migrations/0008_subdomains.sql

@@ -0,0 +1,18 @@
+-- +goose Up
+CREATE TABLE subdomains (
+    id         TEXT PRIMARY KEY,
+    domain_id  TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+    name       TEXT NOT NULL,
+    ips        JSON NOT NULL DEFAULT '[]',
+    first_seen TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+    last_seen  TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+    UNIQUE(domain_id, name)
+);
+CREATE INDEX subdomains_domain_idx ON subdomains(domain_id);
+
+-- Discovery runs at most once per day per domain, inside the domain sweep.
+ALTER TABLE domains ADD COLUMN sub_checked_at TEXT;
+
+-- +goose Down
+ALTER TABLE domains DROP COLUMN sub_checked_at;
+DROP TABLE IF EXISTS subdomains;