fix(alerts): backend hardening + complete ACKNOWLEDGED migration

- new AlertInstanceRepository.filterInEnvLive(ids, env): single-query bulk ID validation
- AlertController.inEnvLiveIds now one SQL round-trip instead of N
- bulkMarkRead SQL: defense-in-depth AND deleted_at IS NULL
- bulkAck SQL already had deleted_at IS NULL guard — no change needed
- PostgresAlertInstanceRepositoryIT: add filterInEnvLive_excludes_other_env_and_soft_deleted
- V12MigrationIT: remove alert_reads assertion (table dropped by V17)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cameleer-server-core/src/main/java/com/cameleer/server/core/alerting/AlertInstanceRepository.java

@@ -73,4 +73,10 @@ public interface AlertInstanceRepository {
     void bulkAck(List<UUID> ids, String userId, Instant when);
 
     List<AlertInstance> listFiringDueForReNotify(Instant now);
+
+    /**
+     * Filter the given IDs to those that exist in the given environment and are not
+     * soft-deleted. Single SQL round-trip — avoids N+1 in bulk operations.
+     */
+    List<UUID> filterInEnvLive(List<UUID> ids, UUID environmentId);
 }