feat(license): enforce max_alert_rules at AlertRuleController.create

Adds AlertRuleRepository.count() and a LicenseEnforcer.assertWithinCap
call at the top of the POST handler. Default cap = 2; the 3rd rule
gets the standard 403 envelope. Sibling alert ITs that legitimately
need more than 2 rules get the cap lifted via the test-license helper.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cameleer-server-core/src/main/java/com/cameleer/server/core/alerting/AlertRuleRepository.java

@@ -14,6 +14,9 @@ public interface AlertRuleRepository {
     List<UUID> findRuleIdsByOutboundConnectionId(UUID connectionId);  // used by rulesReferencing()
     void delete(UUID id);
 
+    /** Tenant-wide rule count — feeds the {@code max_alert_rules} license cap. */
+    long count();
+
     /** Claim up to batchSize rules whose next_evaluation_at <= now AND (claimed_until IS NULL OR claimed_until < now).
      *  Atomically sets claimed_by + claimed_until = now + ttl. Returns claimed rules. */
     List<AlertRule> claimDueRules(String instanceId, int batchSize, int claimTtlSeconds);