fix(watch): alert hygiene — no plan gate, own-email only, atomic unsubscribe (TRI-12820)

- the plan half of the alert gate is removed (billing re-attaches later);
  denial is feature flag or missing email transport only
- an alert can only go to the user's own account email; anything else is 400
- unsubscribe is a compare-and-swap (409 on conflict); the summary toast id is
  stable; watch tests no longer import env.server; per-tick re-authorization
  reads the primary, not the replica

Author: kathiekiwi

.server-changes/dashboard-agent-watches.md

@@ -3,4 +3,4 @@ area: webapp
 type: feature
 ---
 
-Ask the dashboard agent to tell you when something happens — a run starting or finishing, a backlog clearing, an error coming back, an environment recovering — and it messages you in the chat once it does. Each chat can wait on up to three things at a time, for up to 24 hours.
+Ask the dashboard agent to tell you when something happens — a run starting or finishing, a queue clearing or growing past a number you pick, an error coming back, an environment recovering — and it messages you in the chat once with the answer. It tells you either way: that the run finished, that it failed, or that the queue still hadn't cleared by the time it stopped looking. If the thing you asked about has already happened, it just says so instead of waiting. Each chat can wait on up to three things at a time, for up to 24 hours.