Add effectiveAlertConfig GraphQL query

[GregorShear]

What

Two related additions to alert-config querying in the control-plane GraphQL API:

1. A top-level query effectiveAlertConfig(catalogPrefixOrName: String!): EffectiveAlertConfig! that resolves the effective alert config for a single prefix or catalog name — merging all ancestor prefix layers over controller defaults.
2. An is exact-match field on the shared PrefixFilter input, alongside the existing starts_with.

Why

The existing alertConfigs query only lists prefixes/names that have an explicit row in alert_configs, each exposing an effective field. There was no way to ask "what is the resolved effective config at scope X?" for a scope that carries no explicit config and is therefore absent from the listing. effectiveAlertConfig is that convenience.

Separately, alertConfigs could only filter by prefix match (startsWith), so requesting one specific prefix also pulled in all of its descendants. is lets a client request a single row by exact catalog_prefix_or_name.

is vs effectiveAlertConfig — which to use

These answer different questions, and both are now available:

• alertConfigs(filter: { catalogPrefixOrName: { is: \"acmeCo/prod/\" } }) returns the stored row at exactly that scope, if one exists — and an empty list if there is no explicit config there. It never resolves inheritance.
• effectiveAlertConfig(catalogPrefixOrName: \"acmeCo/prod/\") returns the resolved config at that scope, merging ancestor layers and controller defaults, whether or not a row exists there.

So is is "show me the raw override stored here"; effectiveAlertConfig is "show me what actually applies here."

How

effectiveAlertConfig query

• Reuses the existing resolve_effective_alert_config helper — the same code path behind the effective field on AlertConfigEntry and effectiveAlertConfig on liveSpec — so resolution/merge/provenance behavior is identical.
• Accepts a prefix (trailing /) or an exact catalog name, validated via the shared validate_prefix_or_name helper. This mirrors the updateAlertConfig mutation's input, giving read/write symmetry at a scope.
• Authorizes Read on the requested scope (satisfiable by Read on any ancestor prefix); ancestor layers merged into the result are visible to anyone who can read the scope, matching the existing effective/effectiveAlertConfig fields.

is filter

• PrefixFilter is shared by the alertConfigs and inviteLinks list queries, so is is wired into both — each adds an exact-equality WHERE condition and uses the exact value (when present) as the authorized-prefix narrowing hint, exactly as startsWith already does. Wiring both avoids exposing an input that silently does nothing.

Regenerates the checked-in control-plane-api.graphql SDL and the sqlx offline query cache.

Testing

• test_effective_alert_config_query: a prefix with no explicit row resolves entirely from defaults (source: null provenance); a deeply-nested prefix with no row of its own inherits an ancestor override, with provenance attributing the overridden field to the ancestor; read on an unauthorized prefix is denied.
• test_alert_configs_filter_is: is: \"aliceCo/\" returns only aliceCo/, while startsWith: \"aliceCo/\" returns aliceCo/ and its descendant.
• All alert-config and invite-links tests pass.