Create an alert rule

Creates an alert rule in the project. The rule is evaluated every 60 seconds. Target: a rule watches a SET of instances named by tags -- target = {kind: instance_selector, match: {key: value, ...}}, every pair must match. The set is resolved inside the rule's project AT EVERY EVALUATION, so an instance tagged after the rule was written is evaluated on the next tick with no further action, and an instance whose tag is removed (or which is deleted) leaves the set: an alert it still holds open is resolved once (event reason=target_deleted) and it stops being billed. Each matched instance runs its OWN FIRING/OK cycle, its own forSeconds clock and its own notification, and target.instances reports each one's state. A selector that matches nothing is accepted: the rule is INSUFFICIENT_DATA until something is tagged. Providers: instance_state -- a matched instance FIRES when it has been in the ERROR state for condition.forSeconds and resolves (OK) when it leaves ERROR. metric -- compares a VM metric (condition.metric: CPU %, memory %, disk MB/s and IOPS, network Mbps, packets, errors, drops) aggregated over the window (condition.aggregation: avg default, or max; per disk / NIC the worst device counts -- the highest for gt/gte, the lowest for lt/lte) against condition.comparator + condition.threshold (all three required). A matched instance whose monitoring is OFF is SKIPPED, not refused: it is not evaluated and not billed, and it is counted in target.monitoringDisabledCount. Switching monitoring off on an instance that is FIRING sends its RESOLVED notification once (event reason=monitoring_disabled). Samples from spans monitoring was off are ignored. provider is an open vocabulary. Condition (window + for): windowSeconds is the aggregation window, at least 60, default 300; forSeconds (default 0) is how long the condition must hold before FIRING. Channels: channelIds are notification channels of the SAME project (at most 10); they receive the FIRING and the RESOLVED notification, never a no-data one. Each notification names the instance it is about. Limit and billing: the unit is the rule x MATCHED INSTANCE -- a rule matching 20 instances uses 20 of the project's 50 (operator adjustable) and bills 20 units per hour while it is enabled; firing costs nothing. Exceeding the limit is 409 QUOTA_EXCEEDED. Errors: a channel outside the project is 404; an empty or malformed match is 422. 409 CONFLICT when the Idempotency-Key was already used for a different request (or for a rule since deleted), or when a conflicting create landed concurrently. Idempotency: Idempotency-Key is optional (recommended); replaying the same key with the same body returns 200 with the same rule. RBAC: MANAGE on the observability plane (owner, contributor).